grsecurity-3.1-4.9.15-20170315004920170315

14 files changed, 2928 insertions, 362 deletions

diff --git a/4.9.14/0000_README b/4.9.15/0000_README
index fc6a48b..5da73c7 100644
--- a/4.9.14/0000_README
+++ b/4.9.15/0000_README
@@ -6,7 +6,11 @@ Patch:	1013_linux-4.9.14.patch
 From:	http://www.kernel.org
 Desc:	Linux 4.9.14
 
-Patch:	4420_grsecurity-3.1-4.9.14-201703121245.patch
+Patch:	1014_linux-4.9.15.patch
+From:	http://www.kernel.org
+Desc:	Linux 4.9.15
+
+Patch:	4420_grsecurity-3.1-4.9.15-201703150049.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/4.9.14/1013_linux-4.9.14.patch b/4.9.15/1013_linux-4.9.14.patch
index 5d8c119..5d8c119 100644
--- a/4.9.14/1013_linux-4.9.14.patch
+++ b/4.9.15/1013_linux-4.9.14.patch
diff --git a/4.9.15/1014_linux-4.9.15.patch b/4.9.15/1014_linux-4.9.15.patch
new file mode 100644
index 0000000..cd11900
--- /dev/null
+++ b/4.9.15/1014_linux-4.9.15.patch
@@ -0,0 +1,2838 @@
+diff --git a/Makefile b/Makefile
+index 5e7706e..03df4fc 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 14
++SUBLEVEL = 15
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
+index 602af69..6bcbbec 100644
+--- a/arch/s390/include/asm/processor.h
++++ b/arch/s390/include/asm/processor.h
+@@ -89,7 +89,8 @@ extern void execve_tail(void);
+  * User space process size: 2GB for 31 bit, 4TB or 8PT for 64 bit.
+  */
+ 
+-#define TASK_SIZE_OF(tsk)	((tsk)->mm->context.asce_limit)
++#define TASK_SIZE_OF(tsk)	((tsk)->mm ? \
++				 (tsk)->mm->context.asce_limit : TASK_MAX_SIZE)
+ #define TASK_UNMAPPED_BASE	(test_thread_flag(TIF_31BIT) ? \
+ 					(1UL << 30) : (1UL << 41))
+ #define TASK_SIZE		TASK_SIZE_OF(current)
+diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c
+index f9293bf..408b4f4 100644
+--- a/arch/s390/kernel/crash_dump.c
++++ b/arch/s390/kernel/crash_dump.c
+@@ -329,7 +329,11 @@ static void *nt_init_name(void *buf, Elf64_Word type, void *desc, int d_len,
+ 
+ static inline void *nt_init(void *buf, Elf64_Word type, void *desc, int d_len)
+ {
+-	return nt_init_name(buf, type, desc, d_len, KEXEC_CORE_NOTE_NAME);
++	const char *note_name = "LINUX";
++
++	if (type == NT_PRPSINFO || type == NT_PRSTATUS || type == NT_PRFPREG)
++		note_name = KEXEC_CORE_NOTE_NAME;
++	return nt_init_name(buf, type, desc, d_len, note_name);
+ }
+ 
+ /*
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
+index d027f2e..e974e53 100644
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -819,10 +819,10 @@ static void __init setup_randomness(void)
+ {
+ 	struct sysinfo_3_2_2 *vmms;
+ 
+-	vmms = (struct sysinfo_3_2_2 *) alloc_page(GFP_KERNEL);
+-	if (vmms && stsi(vmms, 3, 2, 2) == 0 && vmms->count)
+-		add_device_randomness(&vmms, vmms->count);
+-	free_page((unsigned long) vmms);
++	vmms = (struct sysinfo_3_2_2 *) memblock_alloc(PAGE_SIZE, PAGE_SIZE);
++	if (stsi(vmms, 3, 2, 2) == 0 && vmms->count)
++		add_device_randomness(&vmms->vm, sizeof(vmms->vm[0]) * vmms->count);
++	memblock_free((unsigned long) vmms, PAGE_SIZE);
+ }
+ 
+ /*
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 47a1de7..5ba494e 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -442,6 +442,9 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
+ 	struct kvm_memory_slot *memslot;
+ 	int is_dirty = 0;
+ 
++	if (kvm_is_ucontrol(kvm))
++		return -EINVAL;
++
+ 	mutex_lock(&kvm->slots_lock);
+ 
+ 	r = -EINVAL;
+diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
+index 6fa8594..fc5abff 100644
+--- a/arch/x86/include/asm/tlbflush.h
++++ b/arch/x86/include/asm/tlbflush.h
+@@ -188,7 +188,7 @@ static inline void __native_flush_tlb_single(unsigned long addr)
+ 
+ static inline void __flush_tlb_all(void)
+ {
+-	if (static_cpu_has(X86_FEATURE_PGE))
++	if (boot_cpu_has(X86_FEATURE_PGE))
+ 		__flush_tlb_global();
+ 	else
+ 		__flush_tlb();
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 64774f4..69b8f8a 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3693,7 +3693,7 @@ static void fix_rmode_seg(int seg, struct kvm_segment *save)
+ 	}
+ 
+ 	vmcs_write16(sf->selector, var.selector);
+-	vmcs_write32(sf->base, var.base);
++	vmcs_writel(sf->base, var.base);
+ 	vmcs_write32(sf->limit, var.limit);
+ 	vmcs_write32(sf->ar_bytes, vmx_segment_access_rights(&var));
+ }
+@@ -8202,7 +8202,7 @@ static void kvm_flush_pml_buffers(struct kvm *kvm)
+ static void vmx_dump_sel(char *name, uint32_t sel)
+ {
+ 	pr_err("%s sel=0x%04x, attr=0x%05x, limit=0x%08x, base=0x%016lx\n",
+-	       name, vmcs_read32(sel),
++	       name, vmcs_read16(sel),
+ 	       vmcs_read32(sel + GUEST_ES_AR_BYTES - GUEST_ES_SELECTOR),
+ 	       vmcs_read32(sel + GUEST_ES_LIMIT - GUEST_ES_SELECTOR),
+ 	       vmcs_readl(sel + GUEST_ES_BASE - GUEST_ES_SELECTOR));
+diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
+index 0d4fb3e..1680768 100644
+--- a/arch/x86/mm/gup.c
++++ b/arch/x86/mm/gup.c
+@@ -120,6 +120,11 @@ static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
+ 			return 0;
+ 		}
+ 
++		if (!pte_allows_gup(pte_val(pte), write)) {
++			pte_unmap(ptep);
++			return 0;
++		}
++
+ 		if (pte_devmap(pte)) {
+ 			pgmap = get_dev_pagemap(pte_pfn(pte), pgmap);
+ 			if (unlikely(!pgmap)) {
+@@ -127,8 +132,7 @@ static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
+ 				pte_unmap(ptep);
+ 				return 0;
+ 			}
+-		} else if (!pte_allows_gup(pte_val(pte), write) ||
+-			   pte_special(pte)) {
++		} else if (pte_special(pte)) {
+ 			pte_unmap(ptep);
+ 			return 0;
+ 		}
+diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
+index 32cdc2c..a45d32a 100644
+--- a/arch/xtensa/kernel/setup.c
++++ b/arch/xtensa/kernel/setup.c
+@@ -133,6 +133,8 @@ static int __init parse_tag_initrd(const bp_tag_t* tag)
+ 
+ __tagtable(BP_TAG_INITRD, parse_tag_initrd);
+ 
++#endif /* CONFIG_BLK_DEV_INITRD */
++
+ #ifdef CONFIG_OF
+ 
+ static int __init parse_tag_fdt(const bp_tag_t *tag)
+@@ -145,8 +147,6 @@ __tagtable(BP_TAG_FDT, parse_tag_fdt);
+ 
+ #endif /* CONFIG_OF */
+ 
+-#endif /* CONFIG_BLK_DEV_INITRD */
+-
+ static int __init parse_tag_cmdline(const bp_tag_t* tag)
+ {
+ 	strlcpy(command_line, (char *)(tag->data), COMMAND_LINE_SIZE);
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index 6eb6733..d1664df 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -1603,7 +1603,7 @@ static size_t sizeof_nfit_set_info(int num_mappings)
+ 		+ num_mappings * sizeof(struct nfit_set_info_map);
+ }
+ 
+-static int cmp_map(const void *m0, const void *m1)
++static int cmp_map_compat(const void *m0, const void *m1)
+ {
+ 	const struct nfit_set_info_map *map0 = m0;
+ 	const struct nfit_set_info_map *map1 = m1;
+@@ -1612,6 +1612,14 @@ static int cmp_map(const void *m0, const void *m1)
+ 			sizeof(u64));
+ }
+ 
++static int cmp_map(const void *m0, const void *m1)
++{
++	const struct nfit_set_info_map *map0 = m0;
++	const struct nfit_set_info_map *map1 = m1;
++
++	return map0->region_offset - map1->region_offset;
++}
++
+ /* Retrieve the nth entry referencing this spa */
+ static struct acpi_nfit_memory_map *memdev_from_spa(
+ 		struct acpi_nfit_desc *acpi_desc, u16 range_index, int n)
+@@ -1667,6 +1675,12 @@ static int acpi_nfit_init_interleave_set(struct acpi_nfit_desc *acpi_desc,
+ 	sort(&info->mapping[0], nr, sizeof(struct nfit_set_info_map),
+ 			cmp_map, NULL);
+ 	nd_set->cookie = nd_fletcher64(info, sizeof_nfit_set_info(nr), 0);
++
++	/* support namespaces created with the wrong sort order */
++	sort(&info->mapping[0], nr, sizeof(struct nfit_set_info_map),
++			cmp_map_compat, NULL);
++	nd_set->altcookie = nd_fletcher64(info, sizeof_nfit_set_info(nr), 0);
++
+ 	ndr_desc->nd_set = nd_set;
+ 	devm_kfree(dev, info);
+ 
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index fadba88..b793853 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -94,6 +94,7 @@ static const struct usb_device_id ath3k_table[] = {
+ 	{ USB_DEVICE(0x04CA, 0x300f) },
+ 	{ USB_DEVICE(0x04CA, 0x3010) },
+ 	{ USB_DEVICE(0x04CA, 0x3014) },
++	{ USB_DEVICE(0x04CA, 0x3018) },
+ 	{ USB_DEVICE(0x0930, 0x0219) },
+ 	{ USB_DEVICE(0x0930, 0x021c) },
+ 	{ USB_DEVICE(0x0930, 0x0220) },
+@@ -162,6 +163,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
+ 	{ USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 2f633df..dd220fa 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -209,6 +209,7 @@ static const struct usb_device_id blacklist_table[] = {
+ 	{ USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index b9629b2..d1651a5 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -298,6 +298,7 @@ struct sdma_engine;
+  * @event_id1		for channels that use 2 events
+  * @word_size		peripheral access size
+  * @buf_tail		ID of the buffer that was processed
++ * @buf_ptail		ID of the previous buffer that was processed
+  * @num_bd		max NUM_BD. number of descriptors currently handling
+  */
+ struct sdma_channel {
+@@ -309,6 +310,7 @@ struct sdma_channel {
+ 	unsigned int			event_id1;
+ 	enum dma_slave_buswidth		word_size;
+ 	unsigned int			buf_tail;
++	unsigned int			buf_ptail;
+ 	unsigned int			num_bd;
+ 	unsigned int			period_len;
+ 	struct sdma_buffer_descriptor	*bd;
+@@ -700,6 +702,8 @@ static void sdma_update_channel_loop(struct sdma_channel *sdmac)
+ 		sdmac->chn_real_count = bd->mode.count;
+ 		bd->mode.status |= BD_DONE;
+ 		bd->mode.count = sdmac->period_len;
++		sdmac->buf_ptail = sdmac->buf_tail;
++		sdmac->buf_tail = (sdmac->buf_tail + 1) % sdmac->num_bd;
+ 
+ 		/*
+ 		 * The callback is called from the interrupt context in order
+@@ -710,9 +714,6 @@ static void sdma_update_channel_loop(struct sdma_channel *sdmac)
+ 
+ 		dmaengine_desc_get_callback_invoke(&sdmac->desc, NULL);
+ 
+-		sdmac->buf_tail++;
+-		sdmac->buf_tail %= sdmac->num_bd;
+-
+ 		if (error)
+ 			sdmac->status = old_status;
+ 	}
+@@ -1186,6 +1187,8 @@ static struct dma_async_tx_descriptor *sdma_prep_slave_sg(
+ 	sdmac->flags = 0;
+ 
+ 	sdmac->buf_tail = 0;
++	sdmac->buf_ptail = 0;
++	sdmac->chn_real_count = 0;
+ 
+ 	dev_dbg(sdma->dev, "setting up %d entries for channel %d.\n",
+ 			sg_len, channel);
+@@ -1288,6 +1291,8 @@ static struct dma_async_tx_descriptor *sdma_prep_dma_cyclic(
+ 	sdmac->status = DMA_IN_PROGRESS;
+ 
+ 	sdmac->buf_tail = 0;
++	sdmac->buf_ptail = 0;
++	sdmac->chn_real_count = 0;
+ 	sdmac->period_len = period_len;
+ 
+ 	sdmac->flags |= IMX_DMA_SG_LOOP;
+@@ -1385,7 +1390,7 @@ static enum dma_status sdma_tx_status(struct dma_chan *chan,
+ 	u32 residue;
+ 
+ 	if (sdmac->flags & IMX_DMA_SG_LOOP)
+-		residue = (sdmac->num_bd - sdmac->buf_tail) *
++		residue = (sdmac->num_bd - sdmac->buf_ptail) *
+ 			   sdmac->period_len - sdmac->chn_real_count;
+ 	else
+ 		residue = sdmac->chn_count - sdmac->chn_real_count;
+diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+index 7ddc321..64a1df6 100644
+--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+@@ -3814,9 +3814,15 @@ static void dce_v11_0_encoder_add(struct amdgpu_device *adev,
+ 	default:
+ 		encoder->possible_crtcs = 0x3;
+ 		break;
++	case 3:
++		encoder->possible_crtcs = 0x7;
++		break;
+ 	case 4:
+ 		encoder->possible_crtcs = 0xf;
+ 		break;
++	case 5:
++		encoder->possible_crtcs = 0x1f;
++		break;
+ 	case 6:
+ 		encoder->possible_crtcs = 0x3f;
+ 		break;
+diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c
+index 810c51d..30672a3 100644
+--- a/drivers/gpu/drm/ast/ast_post.c
++++ b/drivers/gpu/drm/ast/ast_post.c
+@@ -58,13 +58,9 @@ bool ast_is_vga_enabled(struct drm_device *dev)
+ 		/* TODO 1180 */
+ 	} else {
+ 		ch = ast_io_read8(ast, AST_IO_VGA_ENABLE_PORT);
+-		if (ch) {
+-			ast_open_key(ast);
+-			ch = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb6, 0xff);
+-			return ch & 0x04;
+-		}
++		return !!(ch & 0x01);
+ 	}
+-	return 0;
++	return false;
+ }
+ 
+ static const u8 extreginfo[] = { 0x0f, 0x04, 0x1c, 0xff };
+@@ -375,8 +371,8 @@ void ast_post_gpu(struct drm_device *dev)
+ 	pci_write_config_dword(ast->dev->pdev, 0x04, reg);
+ 
+ 	ast_enable_vga(dev);
+-	ast_enable_mmio(dev);
+ 	ast_open_key(ast);
++	ast_enable_mmio(dev);
+ 	ast_set_def_ext_reg(dev);
+ 
+ 	if (ast->chip == AST2300 || ast->chip == AST2400)
+@@ -1630,12 +1626,44 @@ static void ast_init_dram_2300(struct drm_device *dev)
+ 		temp |= 0x73;
+ 		ast_write32(ast, 0x12008, temp);
+ 
++		param.dram_freq = 396;
+ 		param.dram_type = AST_DDR3;
++		temp = ast_mindwm(ast, 0x1e6e2070);
+ 		if (temp & 0x01000000)
+ 			param.dram_type = AST_DDR2;
+-		param.dram_chipid = ast->dram_type;
+-		param.dram_freq = ast->mclk;
+-		param.vram_size = ast->vram_size;
++                switch (temp & 0x18000000) {
++		case 0:
++			param.dram_chipid = AST_DRAM_512Mx16;
++			break;
++		default:
++		case 0x08000000:
++			param.dram_chipid = AST_DRAM_1Gx16;
++			break;
++		case 0x10000000:
++			param.dram_chipid = AST_DRAM_2Gx16;
++			break;
++		case 0x18000000:
++			param.dram_chipid = AST_DRAM_4Gx16;
++			break;
++		}
++                switch (temp & 0x0c) {
++                default:
++		case 0x00:
++			param.vram_size = AST_VIDMEM_SIZE_8M;
++			break;
++
++		case 0x04:
++			param.vram_size = AST_VIDMEM_SIZE_16M;
++			break;
++
++		case 0x08:
++			param.vram_size = AST_VIDMEM_SIZE_32M;
++			break;
++
++		case 0x0c:
++			param.vram_size = AST_VIDMEM_SIZE_64M;
++			break;
++		}
+ 
+ 		if (param.dram_type == AST_DDR3) {
+ 			get_ddr3_info(ast, &param);
+diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
+index a05bb38..2e42a05 100644
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -362,7 +362,7 @@ mode_fixup(struct drm_atomic_state *state)
+ 	struct drm_connector *connector;
+ 	struct drm_connector_state *conn_state;
+ 	int i;
+-	bool ret;
++	int ret;
+ 
+ 	for_each_crtc_in_state(state, crtc, crtc_state, i) {
+ 		if (!crtc_state->mode_changed &&
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index ec77bd3..7491180 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -145,6 +145,9 @@ static struct edid_quirk {
+ 
+ 	/* Panel in Samsung NP700G7A-S01PL notebook reports 6bpc */
+ 	{ "SEC", 0xd033, EDID_QUIRK_FORCE_8BPC },
++
++	/* Rotel RSX-1058 forwards sink's EDID but only does HDMI 1.1*/
++	{ "ETR", 13896, EDID_QUIRK_FORCE_8BPC },
+ };
+ 
+ /*
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index 6c75e62..6a48d66 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -848,6 +848,9 @@ void drm_fb_helper_fini(struct drm_fb_helper *fb_helper)
+ 	if (!drm_fbdev_emulation)
+ 		return;
+ 
++	cancel_work_sync(&fb_helper->resume_work);
++	cancel_work_sync(&fb_helper->dirty_work);
++
+ 	if (!list_empty(&fb_helper->kernel_fb_list)) {
+ 		list_del(&fb_helper->kernel_fb_list);
+ 		if (list_empty(&kernel_fb_helper_list)) {
+diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
+index 9a71ed5..f46aac1 100644
+--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
++++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
+@@ -415,6 +415,11 @@ int i915_gem_init_stolen(struct drm_device *dev)
+ 
+ 	mutex_init(&dev_priv->mm.stolen_lock);
+ 
++	if (intel_vgpu_active(dev_priv)) {
++		DRM_INFO("iGVT-g active, disabling use of stolen memory\n");
++		return 0;
++	}
++
+ #ifdef CONFIG_INTEL_IOMMU
+ 	if (intel_iommu_gfx_mapped && INTEL_INFO(dev)->gen < 8) {
+ 		DRM_INFO("DMAR active, disabling use of stolen memory\n");
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index 0555250..7b06280 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -2832,6 +2832,9 @@ static void vlv_detach_power_sequencer(struct intel_dp *intel_dp)
+ 	enum pipe pipe = intel_dp->pps_pipe;
+ 	i915_reg_t pp_on_reg = PP_ON_DELAYS(pipe);
+ 
++	if (WARN_ON(pipe != PIPE_A && pipe != PIPE_B))
++		return;
++
+ 	edp_panel_vdd_off_sync(intel_dp);
+ 
+ 	/*
+@@ -2859,9 +2862,6 @@ static void vlv_steal_power_sequencer(struct drm_device *dev,
+ 
+ 	lockdep_assert_held(&dev_priv->pps_mutex);
+ 
+-	if (WARN_ON(pipe != PIPE_A && pipe != PIPE_B))
+-		return;
+-
+ 	for_each_intel_encoder(dev, encoder) {
+ 		struct intel_dp *intel_dp;
+ 		enum port port;
+diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
+index 7acbbbf..4534e4c 100644
+--- a/drivers/gpu/drm/i915/intel_opregion.c
++++ b/drivers/gpu/drm/i915/intel_opregion.c
+@@ -1031,7 +1031,18 @@ int intel_opregion_setup(struct drm_i915_private *dev_priv)
+ 			opregion->vbt_size = vbt_size;
+ 		} else {
+ 			vbt = base + OPREGION_VBT_OFFSET;
+-			vbt_size = OPREGION_ASLE_EXT_OFFSET - OPREGION_VBT_OFFSET;
++			/*
++			 * The VBT specification says that if the ASLE ext
++			 * mailbox is not used its area is reserved, but
++			 * on some CHT boards the VBT extends into the
++			 * ASLE ext area. Allow this even though it is
++			 * against the spec, so we do not end up rejecting
++			 * the VBT on those boards (and end up not finding the
++			 * LCD panel because of this).
++			 */
++			vbt_size = (mboxes & MBOX_ASLE_EXT) ?
++				OPREGION_ASLE_EXT_OFFSET : OPREGION_SIZE;
++			vbt_size -= OPREGION_VBT_OFFSET;
+ 			if (intel_bios_is_valid_vbt(vbt, vbt_size)) {
+ 				DRM_DEBUG_KMS("Found valid VBT in ACPI OpRegion (Mailbox #4)\n");
+ 				opregion->vbt = vbt;
+diff --git a/drivers/gpu/drm/imx/imx-tve.c b/drivers/gpu/drm/imx/imx-tve.c
+index 8fc0888..89cf009 100644
+--- a/drivers/gpu/drm/imx/imx-tve.c
++++ b/drivers/gpu/drm/imx/imx-tve.c
+@@ -98,6 +98,8 @@
+ /* TVE_TST_MODE_REG */
+ #define TVE_TVDAC_TEST_MODE_MASK	(0x7 << 0)
+ 
++#define IMX_TVE_DAC_VOLTAGE	2750000
++
+ enum {
+ 	TVE_MODE_TVOUT,
+ 	TVE_MODE_VGA,
+@@ -628,9 +630,8 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data)
+ 
+ 	tve->dac_reg = devm_regulator_get(dev, "dac");
+ 	if (!IS_ERR(tve->dac_reg)) {
+-		ret = regulator_set_voltage(tve->dac_reg, 2750000, 2750000);
+-		if (ret)
+-			return ret;
++		if (regulator_get_voltage(tve->dac_reg) != IMX_TVE_DAC_VOLTAGE)
++			dev_warn(dev, "dac voltage is not %d uV\n", IMX_TVE_DAC_VOLTAGE);
+ 		ret = regulator_enable(tve->dac_reg);
+ 		if (ret)
+ 			return ret;
+diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
+index fc6217d..35cc16f 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -1654,7 +1654,6 @@ static int ttm_bo_swapout(struct ttm_mem_shrink *shrink)
+ 	struct ttm_buffer_object *bo;
+ 	int ret = -EBUSY;
+ 	int put_count;
+-	uint32_t swap_placement = (TTM_PL_FLAG_CACHED | TTM_PL_FLAG_SYSTEM);
+ 
+ 	spin_lock(&glob->lru_lock);
+ 	list_for_each_entry(bo, &glob->swap_lru, swap) {
+@@ -1685,7 +1684,8 @@ static int ttm_bo_swapout(struct ttm_mem_shrink *shrink)
+ 	 * Move to system cached
+ 	 */
+ 
+-	if ((bo->mem.placement & swap_placement) != swap_placement) {
++	if (bo->mem.mem_type != TTM_PL_SYSTEM ||
++	    bo->ttm->caching_state != tt_cached) {
+ 		struct ttm_mem_reg evict_mem;
+ 
+ 		evict_mem = bo->mem;
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+index 18061a4..36005bd 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -199,9 +199,14 @@ static const struct drm_ioctl_desc vmw_ioctls[] = {
+ 	VMW_IOCTL_DEF(VMW_PRESENT_READBACK,
+ 		      vmw_present_readback_ioctl,
+ 		      DRM_MASTER | DRM_AUTH),
++	/*
++	 * The permissions of the below ioctl are overridden in
++	 * vmw_generic_ioctl(). We require either
++	 * DRM_MASTER or capable(CAP_SYS_ADMIN).
++	 */
+ 	VMW_IOCTL_DEF(VMW_UPDATE_LAYOUT,
+ 		      vmw_kms_update_layout_ioctl,
+-		      DRM_MASTER | DRM_CONTROL_ALLOW),
++		      DRM_RENDER_ALLOW),
+ 	VMW_IOCTL_DEF(VMW_CREATE_SHADER,
+ 		      vmw_shader_define_ioctl,
+ 		      DRM_AUTH | DRM_RENDER_ALLOW),
+@@ -1125,6 +1130,10 @@ static long vmw_generic_ioctl(struct file *filp, unsigned int cmd,
+ 
+ 			return (long) vmw_execbuf_ioctl(dev, arg, file_priv,
+ 							_IOC_SIZE(cmd));
++		} else if (nr == DRM_COMMAND_BASE + DRM_VMW_UPDATE_LAYOUT) {
++			if (!drm_is_current_master(file_priv) &&
++			    !capable(CAP_SYS_ADMIN))
++				return -EACCES;
+ 		}
+ 
+ 		if (unlikely(ioctl->cmd != cmd))
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+index 1e59a48..59ff419 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+@@ -41,9 +41,9 @@
+ #include <drm/ttm/ttm_module.h>
+ #include "vmwgfx_fence.h"
+ 
+-#define VMWGFX_DRIVER_DATE "20160210"
++#define VMWGFX_DRIVER_DATE "20170221"
+ #define VMWGFX_DRIVER_MAJOR 2
+-#define VMWGFX_DRIVER_MINOR 11
++#define VMWGFX_DRIVER_MINOR 12
+ #define VMWGFX_DRIVER_PATCHLEVEL 0
+ #define VMWGFX_FILE_PAGE_OFFSET 0x00100000
+ #define VMWGFX_FIFO_STATIC_SIZE (1024*1024)
+diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
+index 6e49a4d..e0a8216 100644
+--- a/drivers/hv/hv.c
++++ b/drivers/hv/hv.c
+@@ -220,7 +220,7 @@ int hv_init(void)
+ 	/* See if the hypercall page is already set */
+ 	rdmsrl(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64);
+ 
+-	virtaddr = __vmalloc(PAGE_SIZE, GFP_KERNEL, PAGE_KERNEL_EXEC);
++	virtaddr = __vmalloc(PAGE_SIZE, GFP_KERNEL, PAGE_KERNEL_RX);
+ 
+ 	if (!virtaddr)
+ 		goto cleanup;
+diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c
+index 729b069..d61fd2c 100644
+--- a/drivers/infiniband/hw/mlx5/srq.c
++++ b/drivers/infiniband/hw/mlx5/srq.c
+@@ -165,8 +165,6 @@ static int create_srq_kernel(struct mlx5_ib_dev *dev, struct mlx5_ib_srq *srq,
+ 	int err;
+ 	int i;
+ 	struct mlx5_wqe_srq_next_seg *next;
+-	int page_shift;
+-	int npages;
+ 
+ 	err = mlx5_db_alloc(dev->mdev, &srq->db);
+ 	if (err) {
+@@ -179,7 +177,6 @@ static int create_srq_kernel(struct mlx5_ib_dev *dev, struct mlx5_ib_srq *srq,
+ 		err = -ENOMEM;
+ 		goto err_db;
+ 	}
+-	page_shift = srq->buf.page_shift;
+ 
+ 	srq->head    = 0;
+ 	srq->tail    = srq->msrq.max - 1;
+@@ -191,10 +188,8 @@ static int create_srq_kernel(struct mlx5_ib_dev *dev, struct mlx5_ib_srq *srq,
+ 			cpu_to_be16((i + 1) & (srq->msrq.max - 1));
+ 	}
+ 
+-	npages = DIV_ROUND_UP(srq->buf.npages, 1 << (page_shift - PAGE_SHIFT));
+-	mlx5_ib_dbg(dev, "buf_size %d, page_shift %d, npages %d, calc npages %d\n",
+-		    buf_size, page_shift, srq->buf.npages, npages);
+-	in->pas = mlx5_vzalloc(sizeof(*in->pas) * npages);
++	mlx5_ib_dbg(dev, "srq->buf.page_shift = %d\n", srq->buf.page_shift);
++	in->pas = mlx5_vzalloc(sizeof(*in->pas) * srq->buf.npages);
+ 	if (!in->pas) {
+ 		err = -ENOMEM;
+ 		goto err_buf;
+@@ -210,7 +205,7 @@ static int create_srq_kernel(struct mlx5_ib_dev *dev, struct mlx5_ib_srq *srq,
+ 	}
+ 	srq->wq_sig = !!srq_signature;
+ 
+-	in->log_page_size = page_shift - MLX5_ADAPTER_PAGE_SHIFT;
++	in->log_page_size = srq->buf.page_shift - MLX5_ADAPTER_PAGE_SHIFT;
+ 	if (MLX5_CAP_GEN(dev->mdev, cqe_version) == MLX5_CQE_VERSION_V1 &&
+ 	    in->type == IB_SRQT_XRC)
+ 		in->user_index = MLX5_IB_DEFAULT_UIDX;
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+index 81a8080..0616a65 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -1511,12 +1511,14 @@ static ssize_t set_mode(struct device *d, struct device_attribute *attr,
+ 
+ 	ret = ipoib_set_mode(dev, buf);
+ 
+-	rtnl_unlock();
+-
+-	if (!ret)
+-		return count;
++	/* The assumption is that the function ipoib_set_mode returned
++	 * with the rtnl held by it, if not the value -EBUSY returned,
++	 * then no need to rtnl_unlock
++	 */
++	if (ret != -EBUSY)
++		rtnl_unlock();
+ 
+-	return ret;
++	return (!ret || ret == -EBUSY) ? count : ret;
+ }
+ 
+ static DEVICE_ATTR(mode, S_IWUSR | S_IRUGO, show_mode, set_mode);
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index b58d9dc..3ef7b8f 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -468,8 +468,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf)
+ 		priv->tx_wr.wr.send_flags &= ~IB_SEND_IP_CSUM;
+ 
+ 		ipoib_flush_paths(dev);
+-		rtnl_lock();
+-		return 0;
++		return (!rtnl_trylock()) ? -EBUSY : 0;
+ 	}
+ 
+ 	if (!strcmp(buf, "datagram\n")) {
+@@ -478,8 +477,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf)
+ 		dev_set_mtu(dev, min(priv->mcast_mtu, dev->mtu));
+ 		rtnl_unlock();
+ 		ipoib_flush_paths(dev);
+-		rtnl_lock();
+-		return 0;
++		return (!rtnl_trylock()) ? -EBUSY : 0;
+ 	}
+ 
+ 	return -EINVAL;
+@@ -703,6 +701,14 @@ int ipoib_check_sm_sendonly_fullmember_support(struct ipoib_dev_priv *priv)
+ 	return ret;
+ }
+ 
++static void push_pseudo_header(struct sk_buff *skb, const char *daddr)
++{
++	struct ipoib_pseudo_header *phdr;
++
++	phdr = (struct ipoib_pseudo_header *)skb_push(skb, sizeof(*phdr));
++	memcpy(phdr->hwaddr, daddr, INFINIBAND_ALEN);
++}
++
+ void ipoib_flush_paths(struct net_device *dev)
+ {
+ 	struct ipoib_dev_priv *priv = netdev_priv(dev);
+@@ -927,8 +933,7 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr,
+ 			}
+ 			if (skb_queue_len(&neigh->queue) <
+ 			    IPOIB_MAX_PATH_REC_QUEUE) {
+-				/* put pseudoheader back on for next time */
+-				skb_push(skb, IPOIB_PSEUDO_LEN);
++				push_pseudo_header(skb, neigh->daddr);
+ 				__skb_queue_tail(&neigh->queue, skb);
+ 			} else {
+ 				ipoib_warn(priv, "queue length limit %d. Packet drop.\n",
+@@ -946,10 +951,12 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr,
+ 
+ 		if (!path->query && path_rec_start(dev, path))
+ 			goto err_path;
+-		if (skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE)
++		if (skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
++			push_pseudo_header(skb, neigh->daddr);
+ 			__skb_queue_tail(&neigh->queue, skb);
+-		else
++		} else {
+ 			goto err_drop;
++		}
+ 	}
+ 
+ 	spin_unlock_irqrestore(&priv->lock, flags);
+@@ -985,8 +992,7 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
+ 		}
+ 		if (path) {
+ 			if (skb_queue_len(&path->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
+-				/* put pseudoheader back on for next time */
+-				skb_push(skb, IPOIB_PSEUDO_LEN);
++				push_pseudo_header(skb, phdr->hwaddr);
+ 				__skb_queue_tail(&path->queue, skb);
+ 			} else {
+ 				++dev->stats.tx_dropped;
+@@ -1018,8 +1024,7 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
+ 		return;
+ 	} else if ((path->query || !path_rec_start(dev, path)) &&
+ 		   skb_queue_len(&path->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
+-		/* put pseudoheader back on for next time */
+-		skb_push(skb, IPOIB_PSEUDO_LEN);
++		push_pseudo_header(skb, phdr->hwaddr);
+ 		__skb_queue_tail(&path->queue, skb);
+ 	} else {
+ 		++dev->stats.tx_dropped;
+@@ -1100,8 +1105,7 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	}
+ 
+ 	if (skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
+-		/* put pseudoheader back on for next time */
+-		skb_push(skb, sizeof(*phdr));
++		push_pseudo_header(skb, phdr->hwaddr);
+ 		spin_lock_irqsave(&priv->lock, flags);
+ 		__skb_queue_tail(&neigh->queue, skb);
+ 		spin_unlock_irqrestore(&priv->lock, flags);
+@@ -1133,7 +1137,6 @@ static int ipoib_hard_header(struct sk_buff *skb,
+ 			     unsigned short type,
+ 			     const void *daddr, const void *saddr, unsigned len)
+ {
+-	struct ipoib_pseudo_header *phdr;
+ 	struct ipoib_header *header;
+ 
+ 	header = (struct ipoib_header *) skb_push(skb, sizeof *header);
+@@ -1146,8 +1149,7 @@ static int ipoib_hard_header(struct sk_buff *skb,
+ 	 * destination address into skb hard header so we can figure out where
+ 	 * to send the packet later.
+ 	 */
+-	phdr = (struct ipoib_pseudo_header *) skb_push(skb, sizeof(*phdr));
+-	memcpy(phdr->hwaddr, daddr, INFINIBAND_ALEN);
++	push_pseudo_header(skb, daddr);
+ 
+ 	return IPOIB_HARD_LEN;
+ }
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index e7dcf14..1eee8f7 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -366,7 +366,6 @@ static struct srp_fr_pool *srp_create_fr_pool(struct ib_device *device,
+ 	struct srp_fr_desc *d;
+ 	struct ib_mr *mr;
+ 	int i, ret = -EINVAL;
+-	enum ib_mr_type mr_type;
+ 
+ 	if (pool_size <= 0)
+ 		goto err;
+@@ -380,13 +379,9 @@ static struct srp_fr_pool *srp_create_fr_pool(struct ib_device *device,
+ 	spin_lock_init(&pool->lock);
+ 	INIT_LIST_HEAD(&pool->free_list);
+ 
+-	if (device->attrs.device_cap_flags & IB_DEVICE_SG_GAPS_REG)
+-		mr_type = IB_MR_TYPE_SG_GAPS;
+-	else
+-		mr_type = IB_MR_TYPE_MEM_REG;
+-
+ 	for (i = 0, d = &pool->desc[0]; i < pool->size; i++, d++) {
+-		mr = ib_alloc_mr(pd, mr_type, max_page_list_len);
++		mr = ib_alloc_mr(pd, IB_MR_TYPE_MEM_REG,
++				 max_page_list_len);
+ 		if (IS_ERR(mr)) {
+ 			ret = PTR_ERR(mr);
+ 			goto destroy_pool;
+@@ -1877,17 +1872,24 @@ static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp)
+ 	if (unlikely(rsp->tag & SRP_TAG_TSK_MGMT)) {
+ 		spin_lock_irqsave(&ch->lock, flags);
+ 		ch->req_lim += be32_to_cpu(rsp->req_lim_delta);
++		if (rsp->tag == ch->tsk_mgmt_tag) {
++			ch->tsk_mgmt_status = -1;
++			if (be32_to_cpu(rsp->resp_data_len) >= 4)
++				ch->tsk_mgmt_status = rsp->data[3];
++			complete(&ch->tsk_mgmt_done);
++		} else {
++			shost_printk(KERN_ERR, target->scsi_host,
++				     "Received tsk mgmt response too late for tag %#llx\n",
++				     rsp->tag);
++		}
+ 		spin_unlock_irqrestore(&ch->lock, flags);
+-
+-		ch->tsk_mgmt_status = -1;
+-		if (be32_to_cpu(rsp->resp_data_len) >= 4)
+-			ch->tsk_mgmt_status = rsp->data[3];
+-		complete(&ch->tsk_mgmt_done);
+ 	} else {
+ 		scmnd = scsi_host_find_tag(target->scsi_host, rsp->tag);
+-		if (scmnd) {
++		if (scmnd && scmnd->host_scribble) {
+ 			req = (void *)scmnd->host_scribble;
+ 			scmnd = srp_claim_req(ch, req, NULL, scmnd);
++		} else {
++			scmnd = NULL;
+ 		}
+ 		if (!scmnd) {
+ 			shost_printk(KERN_ERR, target->scsi_host,
+@@ -2519,19 +2521,18 @@ srp_change_queue_depth(struct scsi_device *sdev, int qdepth)
+ }
+ 
+ static int srp_send_tsk_mgmt(struct srp_rdma_ch *ch, u64 req_tag, u64 lun,
+-			     u8 func)
++			     u8 func, u8 *status)
+ {
+ 	struct srp_target_port *target = ch->target;
+ 	struct srp_rport *rport = target->rport;
+ 	struct ib_device *dev = target->srp_host->srp_dev->dev;
+ 	struct srp_iu *iu;
+ 	struct srp_tsk_mgmt *tsk_mgmt;
++	int res;
+ 
+ 	if (!ch->connected || target->qp_in_error)
+ 		return -1;
+ 
+-	init_completion(&ch->tsk_mgmt_done);
+-
+ 	/*
+ 	 * Lock the rport mutex to avoid that srp_create_ch_ib() is
+ 	 * invoked while a task management function is being sent.
+@@ -2554,10 +2555,16 @@ static int srp_send_tsk_mgmt(struct srp_rdma_ch *ch, u64 req_tag, u64 lun,
+ 
+ 	tsk_mgmt->opcode 	= SRP_TSK_MGMT;
+ 	int_to_scsilun(lun, &tsk_mgmt->lun);
+-	tsk_mgmt->tag		= req_tag | SRP_TAG_TSK_MGMT;
+ 	tsk_mgmt->tsk_mgmt_func = func;
+ 	tsk_mgmt->task_tag	= req_tag;
+ 
++	spin_lock_irq(&ch->lock);
++	ch->tsk_mgmt_tag = (ch->tsk_mgmt_tag + 1) | SRP_TAG_TSK_MGMT;
++	tsk_mgmt->tag = ch->tsk_mgmt_tag;
++	spin_unlock_irq(&ch->lock);
++
++	init_completion(&ch->tsk_mgmt_done);
++
+ 	ib_dma_sync_single_for_device(dev, iu->dma, sizeof *tsk_mgmt,
+ 				      DMA_TO_DEVICE);
+ 	if (srp_post_send(ch, iu, sizeof(*tsk_mgmt))) {
+@@ -2566,13 +2573,15 @@ static int srp_send_tsk_mgmt(struct srp_rdma_ch *ch, u64 req_tag, u64 lun,
+ 
+ 		return -1;
+ 	}
++	res = wait_for_completion_timeout(&ch->tsk_mgmt_done,
++					msecs_to_jiffies(SRP_ABORT_TIMEOUT_MS));
++	if (res > 0 && status)
++		*status = ch->tsk_mgmt_status;
+ 	mutex_unlock(&rport->mutex);
+ 
+-	if (!wait_for_completion_timeout(&ch->tsk_mgmt_done,
+-					 msecs_to_jiffies(SRP_ABORT_TIMEOUT_MS)))
+-		return -1;
++	WARN_ON_ONCE(res < 0);
+ 
+-	return 0;
++	return res > 0 ? 0 : -1;
+ }
+ 
+ static int srp_abort(struct scsi_cmnd *scmnd)
+@@ -2598,7 +2607,7 @@ static int srp_abort(struct scsi_cmnd *scmnd)
+ 	shost_printk(KERN_ERR, target->scsi_host,
+ 		     "Sending SRP abort for tag %#x\n", tag);
+ 	if (srp_send_tsk_mgmt(ch, tag, scmnd->device->lun,
+-			      SRP_TSK_ABORT_TASK) == 0)
++			      SRP_TSK_ABORT_TASK, NULL) == 0)
+ 		ret = SUCCESS;
+ 	else if (target->rport->state == SRP_RPORT_LOST)
+ 		ret = FAST_IO_FAIL;
+@@ -2616,14 +2625,15 @@ static int srp_reset_device(struct scsi_cmnd *scmnd)
+ 	struct srp_target_port *target = host_to_target(scmnd->device->host);
+ 	struct srp_rdma_ch *ch;
+ 	int i;
++	u8 status;
+ 
+ 	shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n");
+ 
+ 	ch = &target->ch[0];
+ 	if (srp_send_tsk_mgmt(ch, SRP_TAG_NO_REQ, scmnd->device->lun,
+-			      SRP_TSK_LUN_RESET))
++			      SRP_TSK_LUN_RESET, &status))
+ 		return FAILED;
+-	if (ch->tsk_mgmt_status)
++	if (status)
+ 		return FAILED;
+ 
+ 	for (i = 0; i < target->ch_count; i++) {
+@@ -2652,9 +2662,8 @@ static int srp_slave_alloc(struct scsi_device *sdev)
+ 	struct Scsi_Host *shost = sdev->host;
+ 	struct srp_target_port *target = host_to_target(shost);
+ 	struct srp_device *srp_dev = target->srp_host->srp_dev;
+-	struct ib_device *ibdev = srp_dev->dev;
+ 
+-	if (!(ibdev->attrs.device_cap_flags & IB_DEVICE_SG_GAPS_REG))
++	if (true)
+ 		blk_queue_virt_boundary(sdev->request_queue,
+ 					~srp_dev->mr_page_mask);
+ 
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.h b/drivers/infiniband/ulp/srp/ib_srp.h
+index 21c6969..32ed40d 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.h
++++ b/drivers/infiniband/ulp/srp/ib_srp.h
+@@ -163,6 +163,7 @@ struct srp_rdma_ch {
+ 	int			max_ti_iu_len;
+ 	int			comp_vector;
+ 
++	u64			tsk_mgmt_tag;
+ 	struct completion	tsk_mgmt_done;
+ 	u8			tsk_mgmt_status;
+ 	bool			connected;
+diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c
+index b5ed3bd..e9ebc4f 100644
+--- a/drivers/memory/atmel-ebi.c
++++ b/drivers/memory/atmel-ebi.c
+@@ -93,7 +93,7 @@ static void at91sam9_ebi_get_config(struct at91_ebi_dev *ebid,
+ 				    struct at91_ebi_dev_config *conf)
+ {
+ 	struct at91sam9_smc_generic_fields *fields = &ebid->ebi->sam9;
+-	unsigned int clk_rate = clk_get_rate(ebid->ebi->clk);
++	unsigned int clk_period = NSEC_PER_SEC / clk_get_rate(ebid->ebi->clk);
+ 	struct at91sam9_ebi_dev_config *config = &conf->sam9;
+ 	struct at91sam9_smc_timings *timings = &config->timings;
+ 	unsigned int val;
+@@ -102,43 +102,43 @@ static void at91sam9_ebi_get_config(struct at91_ebi_dev *ebid,
+ 	config->mode = val & ~AT91_SMC_TDF;
+ 
+ 	val = (val & AT91_SMC_TDF) >> 16;
+-	timings->tdf_ns = clk_rate * val;
++	timings->tdf_ns = clk_period * val;
+ 
+ 	regmap_fields_read(fields->setup, conf->cs, &val);
+ 	timings->ncs_rd_setup_ns = (val >> 24) & 0x1f;
+ 	timings->ncs_rd_setup_ns += ((val >> 29) & 0x1) * 128;
+-	timings->ncs_rd_setup_ns *= clk_rate;
++	timings->ncs_rd_setup_ns *= clk_period;
+ 	timings->nrd_setup_ns = (val >> 16) & 0x1f;
+ 	timings->nrd_setup_ns += ((val >> 21) & 0x1) * 128;
+-	timings->nrd_setup_ns *= clk_rate;
++	timings->nrd_setup_ns *= clk_period;
+ 	timings->ncs_wr_setup_ns = (val >> 8) & 0x1f;
+ 	timings->ncs_wr_setup_ns += ((val >> 13) & 0x1) * 128;
+-	timings->ncs_wr_setup_ns *= clk_rate;
++	timings->ncs_wr_setup_ns *= clk_period;
+ 	timings->nwe_setup_ns = val & 0x1f;
+ 	timings->nwe_setup_ns += ((val >> 5) & 0x1) * 128;
+-	timings->nwe_setup_ns *= clk_rate;
++	timings->nwe_setup_ns *= clk_period;
+ 
+ 	regmap_fields_read(fields->pulse, conf->cs, &val);
+ 	timings->ncs_rd_pulse_ns = (val >> 24) & 0x3f;
+ 	timings->ncs_rd_pulse_ns += ((val >> 30) & 0x1) * 256;
+-	timings->ncs_rd_pulse_ns *= clk_rate;
++	timings->ncs_rd_pulse_ns *= clk_period;
+ 	timings->nrd_pulse_ns = (val >> 16) & 0x3f;
+ 	timings->nrd_pulse_ns += ((val >> 22) & 0x1) * 256;
+-	timings->nrd_pulse_ns *= clk_rate;
++	timings->nrd_pulse_ns *= clk_period;
+ 	timings->ncs_wr_pulse_ns = (val >> 8) & 0x3f;
+ 	timings->ncs_wr_pulse_ns += ((val >> 14) & 0x1) * 256;
+-	timings->ncs_wr_pulse_ns *= clk_rate;
++	timings->ncs_wr_pulse_ns *= clk_period;
+ 	timings->nwe_pulse_ns = val & 0x3f;
+ 	timings->nwe_pulse_ns += ((val >> 6) & 0x1) * 256;
+-	timings->nwe_pulse_ns *= clk_rate;
++	timings->nwe_pulse_ns *= clk_period;
+ 
+ 	regmap_fields_read(fields->cycle, conf->cs, &val);
+ 	timings->nrd_cycle_ns = (val >> 16) & 0x7f;
+ 	timings->nrd_cycle_ns += ((val >> 23) & 0x3) * 256;
+-	timings->nrd_cycle_ns *= clk_rate;
++	timings->nrd_cycle_ns *= clk_period;
+ 	timings->nwe_cycle_ns = val & 0x7f;
+ 	timings->nwe_cycle_ns += ((val >> 7) & 0x3) * 256;
+-	timings->nwe_cycle_ns *= clk_rate;
++	timings->nwe_cycle_ns *= clk_period;
+ }
+ 
+ static int at91_xlate_timing(struct device_node *np, const char *prop,
+@@ -334,6 +334,7 @@ static int at91sam9_ebi_apply_config(struct at91_ebi_dev *ebid,
+ 				     struct at91_ebi_dev_config *conf)
+ {
+ 	unsigned int clk_rate = clk_get_rate(ebid->ebi->clk);
++	unsigned int clk_period = NSEC_PER_SEC / clk_rate;
+ 	struct at91sam9_ebi_dev_config *config = &conf->sam9;
+ 	struct at91sam9_smc_timings *timings = &config->timings;
+ 	struct at91sam9_smc_generic_fields *fields = &ebid->ebi->sam9;
+@@ -376,7 +377,7 @@ static int at91sam9_ebi_apply_config(struct at91_ebi_dev *ebid,
+ 	val |= AT91SAM9_SMC_NWECYCLE(coded_val);
+ 	regmap_fields_write(fields->cycle, conf->cs, val);
+ 
+-	val = DIV_ROUND_UP(timings->tdf_ns, clk_rate);
++	val = DIV_ROUND_UP(timings->tdf_ns, clk_period);
+ 	if (val > AT91_SMC_TDF_MAX)
+ 		val = AT91_SMC_TDF_MAX;
+ 	regmap_fields_write(fields->mode, conf->cs,
+diff --git a/drivers/misc/cxl/cxl.h b/drivers/misc/cxl/cxl.h
+index a144073..52ee3da 100644
+--- a/drivers/misc/cxl/cxl.h
++++ b/drivers/misc/cxl/cxl.h
+@@ -419,6 +419,9 @@ struct cxl_afu {
+ 	struct mutex contexts_lock;
+ 	spinlock_t afu_cntl_lock;
+ 
++	/* -1: AFU deconfigured/locked, >= 0: number of readers */
++	atomic_t configured_state;
++
+ 	/* AFU error buffer fields and bin attribute for sysfs */
+ 	u64 eb_len, eb_offset;
+ 	struct bin_attribute attr_eb;
+diff --git a/drivers/misc/cxl/main.c b/drivers/misc/cxl/main.c
+index 62e0dfb..cc1706a 100644
+--- a/drivers/misc/cxl/main.c
++++ b/drivers/misc/cxl/main.c
+@@ -268,7 +268,7 @@ struct cxl_afu *cxl_alloc_afu(struct cxl *adapter, int slice)
+ 	idr_init(&afu->contexts_idr);
+ 	mutex_init(&afu->contexts_lock);
+ 	spin_lock_init(&afu->afu_cntl_lock);
+-
++	atomic_set(&afu->configured_state, -1);
+ 	afu->prefault_mode = CXL_PREFAULT_NONE;
+ 	afu->irqs_max = afu->adapter->user_irqs;
+ 
+diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
+index e96be9c..dd99b06 100644
+--- a/drivers/misc/cxl/pci.c
++++ b/drivers/misc/cxl/pci.c
+@@ -1129,6 +1129,7 @@ static int pci_configure_afu(struct cxl_afu *afu, struct cxl *adapter, struct pc
+ 	if ((rc = cxl_native_register_psl_irq(afu)))
+ 		goto err2;
+ 
++	atomic_set(&afu->configured_state, 0);
+ 	return 0;
+ 
+ err2:
+@@ -1141,6 +1142,14 @@ static int pci_configure_afu(struct cxl_afu *afu, struct cxl *adapter, struct pc
+ 
+ static void pci_deconfigure_afu(struct cxl_afu *afu)
+ {
++	/*
++	 * It's okay to deconfigure when AFU is already locked, otherwise wait
++	 * until there are no readers
++	 */
++	if (atomic_read(&afu->configured_state) != -1) {
++		while (atomic_cmpxchg(&afu->configured_state, 0, -1) != -1)
++			schedule();
++	}
+ 	cxl_native_release_psl_irq(afu);
+ 	if (afu->adapter->native->sl_ops->release_serr_irq)
+ 		afu->adapter->native->sl_ops->release_serr_irq(afu);
+diff --git a/drivers/misc/cxl/vphb.c b/drivers/misc/cxl/vphb.c
+index 3519ace..512a489 100644
+--- a/drivers/misc/cxl/vphb.c
++++ b/drivers/misc/cxl/vphb.c
+@@ -76,23 +76,32 @@ static int cxl_pcie_cfg_record(u8 bus, u8 devfn)
+ 	return (bus << 8) + devfn;
+ }
+ 
+-static int cxl_pcie_config_info(struct pci_bus *bus, unsigned int devfn,
+-				struct cxl_afu **_afu, int *_record)
++static inline struct cxl_afu *pci_bus_to_afu(struct pci_bus *bus)
+ {
+-	struct pci_controller *phb;
+-	struct cxl_afu *afu;
+-	int record;
++	struct pci_controller *phb = bus ? pci_bus_to_host(bus) : NULL;
+ 
+-	phb = pci_bus_to_host(bus);
+-	if (phb == NULL)
+-		return PCIBIOS_DEVICE_NOT_FOUND;
++	return phb ? phb->private_data : NULL;
++}
++
++static void cxl_afu_configured_put(struct cxl_afu *afu)
++{
++	atomic_dec_if_positive(&afu->configured_state);
++}
++
++static bool cxl_afu_configured_get(struct cxl_afu *afu)
++{
++	return atomic_inc_unless_negative(&afu->configured_state);
++}
++
++static inline int cxl_pcie_config_info(struct pci_bus *bus, unsigned int devfn,
++				       struct cxl_afu *afu, int *_record)
++{
++	int record;
+ 
+-	afu = (struct cxl_afu *)phb->private_data;
+ 	record = cxl_pcie_cfg_record(bus->number, devfn);
+ 	if (record > afu->crs_num)
+ 		return PCIBIOS_DEVICE_NOT_FOUND;
+ 
+-	*_afu = afu;
+ 	*_record = record;
+ 	return 0;
+ }
+@@ -106,9 +115,14 @@ static int cxl_pcie_read_config(struct pci_bus *bus, unsigned int devfn,
+ 	u16 val16;
+ 	u32 val32;
+ 
+-	rc = cxl_pcie_config_info(bus, devfn, &afu, &record);
++	afu = pci_bus_to_afu(bus);
++	/* Grab a reader lock on afu. */
++	if (afu == NULL || !cxl_afu_configured_get(afu))
++		return PCIBIOS_DEVICE_NOT_FOUND;
++
++	rc = cxl_pcie_config_info(bus, devfn, afu, &record);
+ 	if (rc)
+-		return rc;
++		goto out;
+ 
+ 	switch (len) {
+ 	case 1:
+@@ -127,10 +141,9 @@ static int cxl_pcie_read_config(struct pci_bus *bus, unsigned int devfn,
+ 		WARN_ON(1);
+ 	}
+ 
+-	if (rc)
+-		return PCIBIOS_DEVICE_NOT_FOUND;
+-
+-	return PCIBIOS_SUCCESSFUL;
++out:
++	cxl_afu_configured_put(afu);
++	return rc ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
+ }
+ 
+ static int cxl_pcie_write_config(struct pci_bus *bus, unsigned int devfn,
+@@ -139,9 +152,14 @@ static int cxl_pcie_write_config(struct pci_bus *bus, unsigned int devfn,
+ 	int rc, record;
+ 	struct cxl_afu *afu;
+ 
+-	rc = cxl_pcie_config_info(bus, devfn, &afu, &record);
++	afu = pci_bus_to_afu(bus);
++	/* Grab a reader lock on afu. */
++	if (afu == NULL || !cxl_afu_configured_get(afu))
++		return PCIBIOS_DEVICE_NOT_FOUND;
++
++	rc = cxl_pcie_config_info(bus, devfn, afu, &record);
+ 	if (rc)
+-		return rc;
++		goto out;
+ 
+ 	switch (len) {
+ 	case 1:
+@@ -157,10 +175,9 @@ static int cxl_pcie_write_config(struct pci_bus *bus, unsigned int devfn,
+ 		WARN_ON(1);
+ 	}
+ 
+-	if (rc)
+-		return PCIBIOS_SET_FAILED;
+-
+-	return PCIBIOS_SUCCESSFUL;
++out:
++	cxl_afu_configured_put(afu);
++	return rc ? PCIBIOS_SET_FAILED : PCIBIOS_SUCCESSFUL;
+ }
+ 
+ static struct pci_ops cxl_pcie_pci_ops =
+diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
+index 930c816..0a4e81a 100644
+--- a/drivers/net/ethernet/marvell/mvpp2.c
++++ b/drivers/net/ethernet/marvell/mvpp2.c
+@@ -991,7 +991,7 @@ static void mvpp2_txq_inc_put(struct mvpp2_txq_pcpu *txq_pcpu,
+ 		txq_pcpu->buffs + txq_pcpu->txq_put_index;
+ 	tx_buf->skb = skb;
+ 	tx_buf->size = tx_desc->data_size;
+-	tx_buf->phys = tx_desc->buf_phys_addr;
++	tx_buf->phys = tx_desc->buf_phys_addr + tx_desc->packet_offset;
+ 	txq_pcpu->txq_put_index++;
+ 	if (txq_pcpu->txq_put_index == txq_pcpu->size)
+ 		txq_pcpu->txq_put_index = 0;
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index b892dac..2458e6e 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -1660,7 +1660,7 @@ static u8 brcmf_sdio_rxglom(struct brcmf_sdio *bus, u8 rxseq)
+ 					   pfirst->len, pfirst->next,
+ 					   pfirst->prev);
+ 			skb_unlink(pfirst, &bus->glom);
+-			if (brcmf_sdio_fromevntchan(pfirst->data))
++			if (brcmf_sdio_fromevntchan(&dptr[SDPCM_HWHDR_LEN]))
+ 				brcmf_rx_event(bus->sdiodev->dev, pfirst);
+ 			else
+ 				brcmf_rx_frame(bus->sdiodev->dev, pfirst,
+diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
+index aefca64..a38ae34 100644
+--- a/drivers/nvdimm/namespace_devs.c
++++ b/drivers/nvdimm/namespace_devs.c
+@@ -1700,6 +1700,7 @@ static int select_pmem_id(struct nd_region *nd_region, u8 *pmem_id)
+ struct device *create_namespace_pmem(struct nd_region *nd_region,
+ 		struct nd_namespace_label *nd_label)
+ {
++	u64 altcookie = nd_region_interleave_set_altcookie(nd_region);
+ 	u64 cookie = nd_region_interleave_set_cookie(nd_region);
+ 	struct nd_label_ent *label_ent;
+ 	struct nd_namespace_pmem *nspm;
+@@ -1718,7 +1719,11 @@ struct device *create_namespace_pmem(struct nd_region *nd_region,
+ 	if (__le64_to_cpu(nd_label->isetcookie) != cookie) {
+ 		dev_dbg(&nd_region->dev, "invalid cookie in label: %pUb\n",
+ 				nd_label->uuid);
+-		return ERR_PTR(-EAGAIN);
++		if (__le64_to_cpu(nd_label->isetcookie) != altcookie)
++			return ERR_PTR(-EAGAIN);
++
++		dev_dbg(&nd_region->dev, "valid altcookie in label: %pUb\n",
++				nd_label->uuid);
+ 	}
+ 
+ 	nspm = kzalloc(sizeof(*nspm), GFP_KERNEL);
+@@ -1733,9 +1738,14 @@ struct device *create_namespace_pmem(struct nd_region *nd_region,
+ 	res->name = dev_name(&nd_region->dev);
+ 	res->flags = IORESOURCE_MEM;
+ 
+-	for (i = 0; i < nd_region->ndr_mappings; i++)
+-		if (!has_uuid_at_pos(nd_region, nd_label->uuid, cookie, i))
+-			break;
++	for (i = 0; i < nd_region->ndr_mappings; i++) {
++		if (has_uuid_at_pos(nd_region, nd_label->uuid, cookie, i))
++			continue;
++		if (has_uuid_at_pos(nd_region, nd_label->uuid, altcookie, i))
++			continue;
++		break;
++	}
++
+ 	if (i < nd_region->ndr_mappings) {
+ 		struct nvdimm_drvdata *ndd = to_ndd(&nd_region->mapping[i]);
+ 
+diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h
+index d3b2fca..d869236 100644
+--- a/drivers/nvdimm/nd.h
++++ b/drivers/nvdimm/nd.h
+@@ -327,6 +327,7 @@ struct nd_region *to_nd_region(struct device *dev);
+ int nd_region_to_nstype(struct nd_region *nd_region);
+ int nd_region_register_namespaces(struct nd_region *nd_region, int *err);
+ u64 nd_region_interleave_set_cookie(struct nd_region *nd_region);
++u64 nd_region_interleave_set_altcookie(struct nd_region *nd_region);
+ void nvdimm_bus_lock(struct device *dev);
+ void nvdimm_bus_unlock(struct device *dev);
+ bool is_nvdimm_bus_locked(struct device *dev);
+diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
+index 6af5e62..9cf6f1a 100644
+--- a/drivers/nvdimm/region_devs.c
++++ b/drivers/nvdimm/region_devs.c
+@@ -505,6 +505,15 @@ u64 nd_region_interleave_set_cookie(struct nd_region *nd_region)
+ 	return 0;
+ }
+ 
++u64 nd_region_interleave_set_altcookie(struct nd_region *nd_region)
++{
++	struct nd_interleave_set *nd_set = nd_region->nd_set;
++
++	if (nd_set)
++		return nd_set->altcookie;
++	return 0;
++}
++
+ void nd_mapping_free_labels(struct nd_mapping *nd_mapping)
+ {
+ 	struct nd_label_ent *label_ent, *e;
+diff --git a/drivers/pci/hotplug/pnv_php.c b/drivers/pci/hotplug/pnv_php.c
+index acb2be0..e96973b 100644
+--- a/drivers/pci/hotplug/pnv_php.c
++++ b/drivers/pci/hotplug/pnv_php.c
+@@ -82,7 +82,7 @@ static void pnv_php_free_slot(struct kref *kref)
+ static inline void pnv_php_put_slot(struct pnv_php_slot *php_slot)
+ {
+ 
+-	if (WARN_ON(!php_slot))
++	if (!php_slot)
+ 		return;
+ 
+ 	kref_put(&php_slot->kref, pnv_php_free_slot);
+@@ -436,9 +436,21 @@ static int pnv_php_enable(struct pnv_php_slot *php_slot, bool rescan)
+ 	if (ret)
+ 		return ret;
+ 
+-	/* Proceed if there have nothing behind the slot */
+-	if (presence == OPAL_PCI_SLOT_EMPTY)
++	/*
++	 * Proceed if there have nothing behind the slot. However,
++	 * we should leave the slot in registered state at the
++	 * beginning. Otherwise, the PCI devices inserted afterwards
++	 * won't be probed and populated.
++	 */
++	if (presence == OPAL_PCI_SLOT_EMPTY) {
++		if (!php_slot->power_state_check) {
++			php_slot->power_state_check = true;
++
++			return 0;
++		}
++
+ 		goto scan;
++	}
+ 
+ 	/*
+ 	 * If the power supply to the slot is off, we can't detect
+@@ -713,8 +725,12 @@ static irqreturn_t pnv_php_interrupt(int irq, void *data)
+ 		added = !!(lsts & PCI_EXP_LNKSTA_DLLLA);
+ 	} else if (sts & PCI_EXP_SLTSTA_PDC) {
+ 		ret = pnv_pci_get_presence_state(php_slot->id, &presence);
+-		if (!ret)
++		if (ret) {
++			dev_warn(&pdev->dev, "PCI slot [%s] error %d getting presence (0x%04x), to retry the operation.\n",
++				 php_slot->name, ret, sts);
+ 			return IRQ_HANDLED;
++		}
++
+ 		added = !!(presence == OPAL_PCI_SLOT_PRESENT);
+ 	} else {
+ 		return IRQ_NONE;
+@@ -799,6 +815,14 @@ static void pnv_php_enable_irq(struct pnv_php_slot *php_slot)
+ 	struct pci_dev *pdev = php_slot->pdev;
+ 	int irq, ret;
+ 
++	/*
++	 * The MSI/MSIx interrupt might have been occupied by other
++	 * drivers. Don't populate the surprise hotplug capability
++	 * in that case.
++	 */
++	if (pci_dev_msi_enabled(pdev))
++		return;
++
+ 	ret = pci_enable_device(pdev);
+ 	if (ret) {
+ 		dev_warn(&pdev->dev, "Error %d enabling device\n", ret);
+diff --git a/drivers/pwm/pwm-pca9685.c b/drivers/pwm/pwm-pca9685.c
+index 117fccf..01a6a83 100644
+--- a/drivers/pwm/pwm-pca9685.c
++++ b/drivers/pwm/pwm-pca9685.c
+@@ -65,7 +65,6 @@
+ #define PCA9685_MAXCHAN		0x10
+ 
+ #define LED_FULL		(1 << 4)
+-#define MODE1_RESTART		(1 << 7)
+ #define MODE1_SLEEP		(1 << 4)
+ #define MODE2_INVRT		(1 << 4)
+ #define MODE2_OUTDRV		(1 << 2)
+@@ -117,16 +116,6 @@ static int pca9685_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ 			udelay(500);
+ 
+ 			pca->period_ns = period_ns;
+-
+-			/*
+-			 * If the duty cycle did not change, restart PWM with
+-			 * the same duty cycle to period ratio and return.
+-			 */
+-			if (duty_ns == pca->duty_ns) {
+-				regmap_update_bits(pca->regmap, PCA9685_MODE1,
+-						   MODE1_RESTART, 0x1);
+-				return 0;
+-			}
+ 		} else {
+ 			dev_err(chip->dev,
+ 				"prescaler not set: period out of bounds!\n");
+diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
+index 9d66b4f..415d10a 100644
+--- a/drivers/s390/block/dcssblk.c
++++ b/drivers/s390/block/dcssblk.c
+@@ -892,7 +892,7 @@ dcssblk_direct_access (struct block_device *bdev, sector_t secnum,
+ 	dev_info = bdev->bd_disk->private_data;
+ 	if (!dev_info)
+ 		return -ENODEV;
+-	dev_sz = dev_info->end - dev_info->start;
++	dev_sz = dev_info->end - dev_info->start + 1;
+ 	offset = secnum * 512;
+ 	*kaddr = (void *) dev_info->start + offset;
+ 	*pfn = __pfn_to_pfn_t(PFN_DOWN(dev_info->start + offset), PFN_DEV);
+diff --git a/drivers/s390/cio/ioasm.c b/drivers/s390/cio/ioasm.c
+index 8225da6..4182f60 100644
+--- a/drivers/s390/cio/ioasm.c
++++ b/drivers/s390/cio/ioasm.c
+@@ -165,13 +165,15 @@ int tpi(struct tpi_info *addr)
+ int chsc(void *chsc_area)
+ {
+ 	typedef struct { char _[4096]; } addr_type;
+-	int cc;
++	int cc = -EIO;
+ 
+ 	asm volatile(
+ 		"	.insn	rre,0xb25f0000,%2,0\n"
+-		"	ipm	%0\n"
++		"0:	ipm	%0\n"
+ 		"	srl	%0,28\n"
+-		: "=d" (cc), "=m" (*(addr_type *) chsc_area)
++		"1:\n"
++		EX_TABLE(0b, 1b)
++		: "+d" (cc), "=m" (*(addr_type *) chsc_area)
+ 		: "d" (chsc_area), "m" (*(addr_type *) chsc_area)
+ 		: "cc");
+ 	trace_s390_cio_chsc(chsc_area, cc);
+diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c
+index 5d06253c..30e9fbbf 100644
+--- a/drivers/s390/cio/qdio_thinint.c
++++ b/drivers/s390/cio/qdio_thinint.c
+@@ -147,11 +147,11 @@ static inline void tiqdio_call_inq_handlers(struct qdio_irq *irq)
+ 	struct qdio_q *q;
+ 	int i;
+ 
+-	for_each_input_queue(irq, q, i) {
+-		if (!references_shared_dsci(irq) &&
+-		    has_multiple_inq_on_dsci(irq))
+-			xchg(q->irq_ptr->dsci, 0);
++	if (!references_shared_dsci(irq) &&
++	    has_multiple_inq_on_dsci(irq))
++		xchg(irq->dsci, 0);
+ 
++	for_each_input_queue(irq, q, i) {
+ 		if (q->u.in.queue_start_poll) {
+ 			/* skip if polling is enabled or already in work */
+ 			if (test_and_set_bit(QDIO_QUEUE_IRQS_DISABLED,
+diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
+index ea9617c..cc38a35 100644
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -77,12 +77,16 @@ transport_lookup_cmd_lun(struct se_cmd *se_cmd, u64 unpacked_lun)
+ 					&deve->read_bytes);
+ 
+ 		se_lun = rcu_dereference(deve->se_lun);
++
++		if (!percpu_ref_tryget_live(&se_lun->lun_ref)) {
++			se_lun = NULL;
++			goto out_unlock;
++		}
++
+ 		se_cmd->se_lun = rcu_dereference(deve->se_lun);
+ 		se_cmd->pr_res_key = deve->pr_res_key;
+ 		se_cmd->orig_fe_lun = unpacked_lun;
+ 		se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD;
+-
+-		percpu_ref_get(&se_lun->lun_ref);
+ 		se_cmd->lun_ref_active = true;
+ 
+ 		if ((se_cmd->data_direction == DMA_TO_DEVICE) &&
+@@ -96,6 +100,7 @@ transport_lookup_cmd_lun(struct se_cmd *se_cmd, u64 unpacked_lun)
+ 			goto ref_dev;
+ 		}
+ 	}
++out_unlock:
+ 	rcu_read_unlock();
+ 
+ 	if (!se_lun) {
+@@ -815,6 +820,7 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
+ 	xcopy_lun = &dev->xcopy_lun;
+ 	rcu_assign_pointer(xcopy_lun->lun_se_dev, dev);
+ 	init_completion(&xcopy_lun->lun_ref_comp);
++	init_completion(&xcopy_lun->lun_shutdown_comp);
+ 	INIT_LIST_HEAD(&xcopy_lun->lun_deve_list);
+ 	INIT_LIST_HEAD(&xcopy_lun->lun_dev_link);
+ 	mutex_init(&xcopy_lun->lun_tg_pt_md_mutex);
+diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
+index d99752c..2744251 100644
+--- a/drivers/target/target_core_tpg.c
++++ b/drivers/target/target_core_tpg.c
+@@ -445,7 +445,7 @@ static void core_tpg_lun_ref_release(struct percpu_ref *ref)
+ {
+ 	struct se_lun *lun = container_of(ref, struct se_lun, lun_ref);
+ 
+-	complete(&lun->lun_ref_comp);
++	complete(&lun->lun_shutdown_comp);
+ }
+ 
+ int core_tpg_register(
+@@ -571,6 +571,7 @@ struct se_lun *core_tpg_alloc_lun(
+ 	lun->lun_link_magic = SE_LUN_LINK_MAGIC;
+ 	atomic_set(&lun->lun_acl_count, 0);
+ 	init_completion(&lun->lun_ref_comp);
++	init_completion(&lun->lun_shutdown_comp);
+ 	INIT_LIST_HEAD(&lun->lun_deve_list);
+ 	INIT_LIST_HEAD(&lun->lun_dev_link);
+ 	atomic_set(&lun->lun_tg_pt_secondary_offline, 0);
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 767d1eb6..cae4dea 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -2702,10 +2702,39 @@ void target_wait_for_sess_cmds(struct se_session *se_sess)
+ }
+ EXPORT_SYMBOL(target_wait_for_sess_cmds);
+ 
++static void target_lun_confirm(struct percpu_ref *ref)
++{
++	struct se_lun *lun = container_of(ref, struct se_lun, lun_ref);
++
++	complete(&lun->lun_ref_comp);
++}
++
+ void transport_clear_lun_ref(struct se_lun *lun)
+ {
+-	percpu_ref_kill(&lun->lun_ref);
++	/*
++	 * Mark the percpu-ref as DEAD, switch to atomic_t mode, drop
++	 * the initial reference and schedule confirm kill to be
++	 * executed after one full RCU grace period has completed.
++	 */
++	percpu_ref_kill_and_confirm(&lun->lun_ref, target_lun_confirm);
++	/*
++	 * The first completion waits for percpu_ref_switch_to_atomic_rcu()
++	 * to call target_lun_confirm after lun->lun_ref has been marked
++	 * as __PERCPU_REF_DEAD on all CPUs, and switches to atomic_t
++	 * mode so that percpu_ref_tryget_live() lookup of lun->lun_ref
++	 * fails for all new incoming I/O.
++	 */
+ 	wait_for_completion(&lun->lun_ref_comp);
++	/*
++	 * The second completion waits for percpu_ref_put_many() to
++	 * invoke ->release() after lun->lun_ref has switched to
++	 * atomic_t mode, and lun->lun_ref.count has reached zero.
++	 *
++	 * At this point all target-core lun->lun_ref references have
++	 * been dropped via transport_lun_remove_cmd(), and it's safe
++	 * to proceed with the remaining LUN shutdown.
++	 */
++	wait_for_completion(&lun->lun_shutdown_comp);
+ }
+ 
+ static bool
+diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
+index a7fa016..6d1e2f7 100644
+--- a/drivers/tty/n_hdlc.c
++++ b/drivers/tty/n_hdlc.c
+@@ -114,7 +114,7 @@
+ #define DEFAULT_TX_BUF_COUNT 3
+ 
+ struct n_hdlc_buf {
+-	struct n_hdlc_buf *link;
++	struct list_head  list_item;
+ 	int		  count;
+ 	char		  buf[1];
+ };
+@@ -122,8 +122,7 @@ struct n_hdlc_buf {
+ #define	N_HDLC_BUF_SIZE	(sizeof(struct n_hdlc_buf) + maxframe)
+ 
+ struct n_hdlc_buf_list {
+-	struct n_hdlc_buf *head;
+-	struct n_hdlc_buf *tail;
++	struct list_head  list;
+ 	int		  count;
+ 	spinlock_t	  spinlock;
+ };
+@@ -136,7 +135,6 @@ struct n_hdlc_buf_list {
+  * @backup_tty - TTY to use if tty gets closed
+  * @tbusy - reentrancy flag for tx wakeup code
+  * @woke_up - FIXME: describe this field
+- * @tbuf - currently transmitting tx buffer
+  * @tx_buf_list - list of pending transmit frame buffers
+  * @rx_buf_list - list of received frame buffers
+  * @tx_free_buf_list - list unused transmit frame buffers
+@@ -149,7 +147,6 @@ struct n_hdlc {
+ 	struct tty_struct	*backup_tty;
+ 	int			tbusy;
+ 	int			woke_up;
+-	struct n_hdlc_buf	*tbuf;
+ 	struct n_hdlc_buf_list	tx_buf_list;
+ 	struct n_hdlc_buf_list	rx_buf_list;
+ 	struct n_hdlc_buf_list	tx_free_buf_list;
+@@ -159,6 +156,8 @@ struct n_hdlc {
+ /*
+  * HDLC buffer list manipulation functions
+  */
++static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list,
++						struct n_hdlc_buf *buf);
+ static void n_hdlc_buf_put(struct n_hdlc_buf_list *list,
+ 			   struct n_hdlc_buf *buf);
+ static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *list);
+@@ -208,16 +207,9 @@ static void flush_tx_queue(struct tty_struct *tty)
+ {
+ 	struct n_hdlc *n_hdlc = tty2n_hdlc(tty);
+ 	struct n_hdlc_buf *buf;
+-	unsigned long flags;
+ 
+ 	while ((buf = n_hdlc_buf_get(&n_hdlc->tx_buf_list)))
+ 		n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, buf);
+- 	spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock, flags);
+-	if (n_hdlc->tbuf) {
+-		n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, n_hdlc->tbuf);
+-		n_hdlc->tbuf = NULL;
+-	}
+-	spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags);
+ }
+ 
+ static struct tty_ldisc_ops n_hdlc_ldisc = {
+@@ -283,7 +275,6 @@ static void n_hdlc_release(struct n_hdlc *n_hdlc)
+ 		} else
+ 			break;
+ 	}
+-	kfree(n_hdlc->tbuf);
+ 	kfree(n_hdlc);
+ 	
+ }	/* end of n_hdlc_release() */
+@@ -402,13 +393,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
+ 	n_hdlc->woke_up = 0;
+ 	spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags);
+ 
+-	/* get current transmit buffer or get new transmit */
+-	/* buffer from list of pending transmit buffers */
+-		
+-	tbuf = n_hdlc->tbuf;
+-	if (!tbuf)
+-		tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list);
+-		
++	tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list);
+ 	while (tbuf) {
+ 		if (debuglevel >= DEBUG_LEVEL_INFO)	
+ 			printk("%s(%d)sending frame %p, count=%d\n",
+@@ -420,7 +405,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
+ 
+ 		/* rollback was possible and has been done */
+ 		if (actual == -ERESTARTSYS) {
+-			n_hdlc->tbuf = tbuf;
++			n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf);
+ 			break;
+ 		}
+ 		/* if transmit error, throw frame away by */
+@@ -435,10 +420,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
+ 					
+ 			/* free current transmit buffer */
+ 			n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, tbuf);
+-			
+-			/* this tx buffer is done */
+-			n_hdlc->tbuf = NULL;
+-			
++
+ 			/* wait up sleeping writers */
+ 			wake_up_interruptible(&tty->write_wait);
+ 	
+@@ -448,10 +430,12 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
+ 			if (debuglevel >= DEBUG_LEVEL_INFO)	
+ 				printk("%s(%d)frame %p pending\n",
+ 					__FILE__,__LINE__,tbuf);
+-					
+-			/* buffer not accepted by driver */
+-			/* set this buffer as pending buffer */
+-			n_hdlc->tbuf = tbuf;
++
++			/*
++			 * the buffer was not accepted by driver,
++			 * return it back into tx queue
++			 */
++			n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf);
+ 			break;
+ 		}
+ 	}
+@@ -749,7 +733,8 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
+ 	int error = 0;
+ 	int count;
+ 	unsigned long flags;
+-	
++	struct n_hdlc_buf *buf = NULL;
++
+ 	if (debuglevel >= DEBUG_LEVEL_INFO)	
+ 		printk("%s(%d)n_hdlc_tty_ioctl() called %d\n",
+ 			__FILE__,__LINE__,cmd);
+@@ -763,8 +748,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
+ 		/* report count of read data available */
+ 		/* in next available frame (if any) */
+ 		spin_lock_irqsave(&n_hdlc->rx_buf_list.spinlock,flags);
+-		if (n_hdlc->rx_buf_list.head)
+-			count = n_hdlc->rx_buf_list.head->count;
++		buf = list_first_entry_or_null(&n_hdlc->rx_buf_list.list,
++						struct n_hdlc_buf, list_item);
++		if (buf)
++			count = buf->count;
+ 		else
+ 			count = 0;
+ 		spin_unlock_irqrestore(&n_hdlc->rx_buf_list.spinlock,flags);
+@@ -776,8 +763,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
+ 		count = tty_chars_in_buffer(tty);
+ 		/* add size of next output frame in queue */
+ 		spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock,flags);
+-		if (n_hdlc->tx_buf_list.head)
+-			count += n_hdlc->tx_buf_list.head->count;
++		buf = list_first_entry_or_null(&n_hdlc->tx_buf_list.list,
++						struct n_hdlc_buf, list_item);
++		if (buf)
++			count += buf->count;
+ 		spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock,flags);
+ 		error = put_user(count, (int __user *)arg);
+ 		break;
+@@ -825,14 +814,14 @@ static unsigned int n_hdlc_tty_poll(struct tty_struct *tty, struct file *filp,
+ 		poll_wait(filp, &tty->write_wait, wait);
+ 
+ 		/* set bits for operations that won't block */
+-		if (n_hdlc->rx_buf_list.head)
++		if (!list_empty(&n_hdlc->rx_buf_list.list))
+ 			mask |= POLLIN | POLLRDNORM;	/* readable */
+ 		if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
+ 			mask |= POLLHUP;
+ 		if (tty_hung_up_p(filp))
+ 			mask |= POLLHUP;
+ 		if (!tty_is_writelocked(tty) &&
+-				n_hdlc->tx_free_buf_list.head)
++				!list_empty(&n_hdlc->tx_free_buf_list.list))
+ 			mask |= POLLOUT | POLLWRNORM;	/* writable */
+ 	}
+ 	return mask;
+@@ -856,7 +845,12 @@ static struct n_hdlc *n_hdlc_alloc(void)
+ 	spin_lock_init(&n_hdlc->tx_free_buf_list.spinlock);
+ 	spin_lock_init(&n_hdlc->rx_buf_list.spinlock);
+ 	spin_lock_init(&n_hdlc->tx_buf_list.spinlock);
+-	
++
++	INIT_LIST_HEAD(&n_hdlc->rx_free_buf_list.list);
++	INIT_LIST_HEAD(&n_hdlc->tx_free_buf_list.list);
++	INIT_LIST_HEAD(&n_hdlc->rx_buf_list.list);
++	INIT_LIST_HEAD(&n_hdlc->tx_buf_list.list);
++
+ 	/* allocate free rx buffer list */
+ 	for(i=0;i<DEFAULT_RX_BUF_COUNT;i++) {
+ 		buf = kmalloc(N_HDLC_BUF_SIZE, GFP_KERNEL);
+@@ -884,53 +878,65 @@ static struct n_hdlc *n_hdlc_alloc(void)
+ }	/* end of n_hdlc_alloc() */
+ 
+ /**
++ * n_hdlc_buf_return - put the HDLC buffer after the head of the specified list
++ * @buf_list - pointer to the buffer list
++ * @buf - pointer to the buffer
++ */
++static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list,
++						struct n_hdlc_buf *buf)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&buf_list->spinlock, flags);
++
++	list_add(&buf->list_item, &buf_list->list);
++	buf_list->count++;
++
++	spin_unlock_irqrestore(&buf_list->spinlock, flags);
++}
++
++/**
+  * n_hdlc_buf_put - add specified HDLC buffer to tail of specified list
+- * @list - pointer to buffer list
++ * @buf_list - pointer to buffer list
+  * @buf	- pointer to buffer
+  */
+-static void n_hdlc_buf_put(struct n_hdlc_buf_list *list,
++static void n_hdlc_buf_put(struct n_hdlc_buf_list *buf_list,
+ 			   struct n_hdlc_buf *buf)
+ {
+ 	unsigned long flags;
+-	spin_lock_irqsave(&list->spinlock,flags);
+-	
+-	buf->link=NULL;
+-	if (list->tail)
+-		list->tail->link = buf;
+-	else
+-		list->head = buf;
+-	list->tail = buf;
+-	(list->count)++;
+-	
+-	spin_unlock_irqrestore(&list->spinlock,flags);
+-	
++
++	spin_lock_irqsave(&buf_list->spinlock, flags);
++
++	list_add_tail(&buf->list_item, &buf_list->list);
++	buf_list->count++;
++
++	spin_unlock_irqrestore(&buf_list->spinlock, flags);
+ }	/* end of n_hdlc_buf_put() */
+ 
+ /**
+  * n_hdlc_buf_get - remove and return an HDLC buffer from list
+- * @list - pointer to HDLC buffer list
++ * @buf_list - pointer to HDLC buffer list
+  * 
+  * Remove and return an HDLC buffer from the head of the specified HDLC buffer
+  * list.
+  * Returns a pointer to HDLC buffer if available, otherwise %NULL.
+  */
+-static struct n_hdlc_buf* n_hdlc_buf_get(struct n_hdlc_buf_list *list)
++static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *buf_list)
+ {
+ 	unsigned long flags;
+ 	struct n_hdlc_buf *buf;
+-	spin_lock_irqsave(&list->spinlock,flags);
+-	
+-	buf = list->head;
++
++	spin_lock_irqsave(&buf_list->spinlock, flags);
++
++	buf = list_first_entry_or_null(&buf_list->list,
++						struct n_hdlc_buf, list_item);
+ 	if (buf) {
+-		list->head = buf->link;
+-		(list->count)--;
++		list_del(&buf->list_item);
++		buf_list->count--;
+ 	}
+-	if (!list->head)
+-		list->tail = NULL;
+-	
+-	spin_unlock_irqrestore(&list->spinlock,flags);
++
++	spin_unlock_irqrestore(&buf_list->spinlock, flags);
+ 	return buf;
+-	
+ }	/* end of n_hdlc_buf_get() */
+ 
+ static char hdlc_banner[] __initdata =
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index b98c157..4d09bd4 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -2688,6 +2688,8 @@ enum pci_board_num_t {
+ 	pbn_b0_4_1152000_200,
+ 	pbn_b0_8_1152000_200,
+ 
++	pbn_b0_4_1250000,
++
+ 	pbn_b0_2_1843200,
+ 	pbn_b0_4_1843200,
+ 
+@@ -2919,6 +2921,13 @@ static struct pciserial_board pci_boards[] = {
+ 		.uart_offset	= 0x200,
+ 	},
+ 
++	[pbn_b0_4_1250000] = {
++		.flags		= FL_BASE0,
++		.num_ports	= 4,
++		.base_baud	= 1250000,
++		.uart_offset	= 8,
++	},
++
+ 	[pbn_b0_2_1843200] = {
+ 		.flags		= FL_BASE0,
+ 		.num_ports	= 2,
+@@ -5549,6 +5558,10 @@ static struct pci_device_id serial_pci_tbl[] = {
+ 	{ PCI_DEVICE(0x1c29, 0x1108), .driver_data = pbn_fintek_8 },
+ 	{ PCI_DEVICE(0x1c29, 0x1112), .driver_data = pbn_fintek_12 },
+ 
++	/* MKS Tenta SCOM-080x serial cards */
++	{ PCI_DEVICE(0x1601, 0x0800), .driver_data = pbn_b0_4_1250000 },
++	{ PCI_DEVICE(0x1601, 0xa801), .driver_data = pbn_b0_4_1250000 },
++
+ 	/*
+ 	 * These entries match devices with class COMMUNICATION_SERIAL,
+ 	 * COMMUNICATION_MODEM or COMMUNICATION_MULTISERIAL
+diff --git a/fs/afs/mntpt.c b/fs/afs/mntpt.c
+index 81dd075..d4fb0af 100644
+--- a/fs/afs/mntpt.c
++++ b/fs/afs/mntpt.c
+@@ -202,7 +202,7 @@ static struct vfsmount *afs_mntpt_do_automount(struct dentry *mntpt)
+ 
+ 	/* try and do the mount */
+ 	_debug("--- attempting mount %s -o %s ---", devname, options);
+-	mnt = vfs_kern_mount(&afs_fs_type, 0, devname, options);
++	mnt = vfs_submount(mntpt, &afs_fs_type, devname, options);
+ 	_debug("--- mount result %p ---", mnt);
+ 
+ 	free_page((unsigned long) devname);
+diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
+index e44271d..5db6c8d 100644
+--- a/fs/autofs4/waitq.c
++++ b/fs/autofs4/waitq.c
+@@ -431,8 +431,8 @@ int autofs4_wait(struct autofs_sb_info *sbi,
+ 		memcpy(&wq->name, &qstr, sizeof(struct qstr));
+ 		wq->dev = autofs4_get_dev(sbi);
+ 		wq->ino = autofs4_get_ino(sbi);
+-		wq->uid = current_real_cred()->uid;
+-		wq->gid = current_real_cred()->gid;
++		wq->uid = current_cred()->uid;
++		wq->gid = current_cred()->gid;
+ 		wq->pid = pid;
+ 		wq->tgid = tgid;
+ 		wq->status = -EINTR; /* Status return if interrupted */
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index 6a26c7b..e3e1a80 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -628,6 +628,9 @@ static void __unregister_request(struct ceph_mds_client *mdsc,
+ {
+ 	dout("__unregister_request %p tid %lld\n", req, req->r_tid);
+ 
++	/* Never leave an unregistered request on an unsafe list! */
++	list_del_init(&req->r_unsafe_item);
++
+ 	if (req->r_tid == mdsc->oldest_tid) {
+ 		struct rb_node *p = rb_next(&req->r_node);
+ 		mdsc->oldest_tid = 0;
+@@ -1036,7 +1039,6 @@ static void cleanup_session_requests(struct ceph_mds_client *mdsc,
+ 	while (!list_empty(&session->s_unsafe)) {
+ 		req = list_first_entry(&session->s_unsafe,
+ 				       struct ceph_mds_request, r_unsafe_item);
+-		list_del_init(&req->r_unsafe_item);
+ 		pr_warn_ratelimited(" dropping unsafe request %llu\n",
+ 				    req->r_tid);
+ 		__unregister_request(mdsc, req);
+@@ -2423,7 +2425,6 @@ static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg)
+ 			 * useful we could do with a revised return value.
+ 			 */
+ 			dout("got safe reply %llu, mds%d\n", tid, mds);
+-			list_del_init(&req->r_unsafe_item);
+ 
+ 			/* last unsafe request during umount? */
+ 			if (mdsc->stopping && !__get_oldest_req(mdsc))
+diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
+index ec9dbbc..9156be5 100644
+--- a/fs/cifs/cifs_dfs_ref.c
++++ b/fs/cifs/cifs_dfs_ref.c
+@@ -245,7 +245,8 @@ char *cifs_compose_mount_options(const char *sb_mountdata,
+  * @fullpath:		full path in UNC format
+  * @ref:		server's referral
+  */
+-static struct vfsmount *cifs_dfs_do_refmount(struct cifs_sb_info *cifs_sb,
++static struct vfsmount *cifs_dfs_do_refmount(struct dentry *mntpt,
++		struct cifs_sb_info *cifs_sb,
+ 		const char *fullpath, const struct dfs_info3_param *ref)
+ {
+ 	struct vfsmount *mnt;
+@@ -259,7 +260,7 @@ static struct vfsmount *cifs_dfs_do_refmount(struct cifs_sb_info *cifs_sb,
+ 	if (IS_ERR(mountdata))
+ 		return (struct vfsmount *)mountdata;
+ 
+-	mnt = vfs_kern_mount(&cifs_fs_type, 0, devname, mountdata);
++	mnt = vfs_submount(mntpt, &cifs_fs_type, devname, mountdata);
+ 	kfree(mountdata);
+ 	kfree(devname);
+ 	return mnt;
+@@ -334,7 +335,7 @@ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt)
+ 			mnt = ERR_PTR(-EINVAL);
+ 			break;
+ 		}
+-		mnt = cifs_dfs_do_refmount(cifs_sb,
++		mnt = cifs_dfs_do_refmount(mntpt, cifs_sb,
+ 				full_path, referrals + i);
+ 		cifs_dbg(FYI, "%s: cifs_dfs_do_refmount:%s , mnt:%p\n",
+ 			 __func__, referrals[i].node_name, mnt);
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index f17fcf8..1e30f74 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -187,9 +187,9 @@ static const struct super_operations debugfs_super_operations = {
+ 
+ static struct vfsmount *debugfs_automount(struct path *path)
+ {
+-	struct vfsmount *(*f)(void *);
+-	f = (struct vfsmount *(*)(void *))path->dentry->d_fsdata;
+-	return f(d_inode(path->dentry)->i_private);
++	debugfs_automount_t f;
++	f = (debugfs_automount_t)path->dentry->d_fsdata;
++	return f(path->dentry, d_inode(path->dentry)->i_private);
+ }
+ 
+ static const struct dentry_operations debugfs_dops = {
+@@ -504,7 +504,7 @@ EXPORT_SYMBOL_GPL(debugfs_create_dir);
+  */
+ struct dentry *debugfs_create_automount(const char *name,
+ 					struct dentry *parent,
+-					struct vfsmount *(*f)(void *),
++					debugfs_automount_t f,
+ 					void *data)
+ {
+ 	struct dentry *dentry = start_creating(name, parent);
+diff --git a/fs/fat/inode.c b/fs/fat/inode.c
+index 338d2f7..a2c05f2 100644
+--- a/fs/fat/inode.c
++++ b/fs/fat/inode.c
+@@ -1359,6 +1359,16 @@ static int parse_options(struct super_block *sb, char *options, int is_vfat,
+ 	return 0;
+ }
+ 
++static void fat_dummy_inode_init(struct inode *inode)
++{
++	/* Initialize this dummy inode to work as no-op. */
++	MSDOS_I(inode)->mmu_private = 0;
++	MSDOS_I(inode)->i_start = 0;
++	MSDOS_I(inode)->i_logstart = 0;
++	MSDOS_I(inode)->i_attrs = 0;
++	MSDOS_I(inode)->i_pos = 0;
++}
++
+ static int fat_read_root(struct inode *inode)
+ {
+ 	struct msdos_sb_info *sbi = MSDOS_SB(inode->i_sb);
+@@ -1803,12 +1813,13 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
+ 	fat_inode = new_inode(sb);
+ 	if (!fat_inode)
+ 		goto out_fail;
+-	MSDOS_I(fat_inode)->i_pos = 0;
++	fat_dummy_inode_init(fat_inode);
+ 	sbi->fat_inode = fat_inode;
+ 
+ 	fsinfo_inode = new_inode(sb);
+ 	if (!fsinfo_inode)
+ 		goto out_fail;
++	fat_dummy_inode_init(fsinfo_inode);
+ 	fsinfo_inode->i_ino = MSDOS_FSINFO_INO;
+ 	sbi->fsinfo_inode = fsinfo_inode;
+ 	insert_inode_hash(fsinfo_inode);
+diff --git a/fs/mount.h b/fs/mount.h
+index d2e25d7..d8295f2 100644
+--- a/fs/mount.h
++++ b/fs/mount.h
+@@ -89,7 +89,6 @@ static inline int is_mounted(struct vfsmount *mnt)
+ }
+ 
+ extern struct mount *__lookup_mnt(struct vfsmount *, struct dentry *);
+-extern struct mount *__lookup_mnt_last(struct vfsmount *, struct dentry *);
+ 
+ extern int __legitimize_mnt(struct vfsmount *, unsigned);
+ extern bool legitimize_mnt(struct vfsmount *, unsigned);
+diff --git a/fs/namei.c b/fs/namei.c
+index 5b4eed2..d5e5140 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -1100,7 +1100,6 @@ static int follow_automount(struct path *path, struct nameidata *nd,
+ 			    bool *need_mntput)
+ {
+ 	struct vfsmount *mnt;
+-	const struct cred *old_cred;
+ 	int err;
+ 
+ 	if (!path->dentry->d_op || !path->dentry->d_op->d_automount)
+@@ -1129,9 +1128,7 @@ static int follow_automount(struct path *path, struct nameidata *nd,
+ 	if (nd->total_link_count >= 40)
+ 		return -ELOOP;
+ 
+-	old_cred = override_creds(&init_cred);
+ 	mnt = path->dentry->d_op->d_automount(path);
+-	revert_creds(old_cred);
+ 	if (IS_ERR(mnt)) {
+ 		/*
+ 		 * The filesystem is allowed to return -EISDIR here to indicate
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 7cea503..5e35057 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -641,28 +641,6 @@ struct mount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry)
+ }
+ 
+ /*
+- * find the last mount at @dentry on vfsmount @mnt.
+- * mount_lock must be held.
+- */
+-struct mount *__lookup_mnt_last(struct vfsmount *mnt, struct dentry *dentry)
+-{
+-	struct mount *p, *res = NULL;
+-	p = __lookup_mnt(mnt, dentry);
+-	if (!p)
+-		goto out;
+-	if (!(p->mnt.mnt_flags & MNT_UMOUNT))
+-		res = p;
+-	hlist_for_each_entry_continue(p, mnt_hash) {
+-		if (&p->mnt_parent->mnt != mnt || p->mnt_mountpoint != dentry)
+-			break;
+-		if (!(p->mnt.mnt_flags & MNT_UMOUNT))
+-			res = p;
+-	}
+-out:
+-	return res;
+-}
+-
+-/*
+  * lookup_mnt - Return the first child mount mounted at path
+  *
+  * "First" means first mounted chronologically.  If you create the
+@@ -882,6 +860,13 @@ void mnt_set_mountpoint(struct mount *mnt,
+ 	hlist_add_head(&child_mnt->mnt_mp_list, &mp->m_list);
+ }
+ 
++static void __attach_mnt(struct mount *mnt, struct mount *parent)
++{
++	hlist_add_head_rcu(&mnt->mnt_hash,
++			   m_hash(&parent->mnt, mnt->mnt_mountpoint));
++	list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
++}
++
+ /*
+  * vfsmount lock must be held for write
+  */
+@@ -890,28 +875,45 @@ static void attach_mnt(struct mount *mnt,
+ 			struct mountpoint *mp)
+ {
+ 	mnt_set_mountpoint(parent, mp, mnt);
+-	hlist_add_head_rcu(&mnt->mnt_hash, m_hash(&parent->mnt, mp->m_dentry));
+-	list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
++	__attach_mnt(mnt, parent);
+ }
+ 
+-static void attach_shadowed(struct mount *mnt,
+-			struct mount *parent,
+-			struct mount *shadows)
++void mnt_change_mountpoint(struct mount *parent, struct mountpoint *mp, struct mount *mnt)
+ {
+-	if (shadows) {
+-		hlist_add_behind_rcu(&mnt->mnt_hash, &shadows->mnt_hash);
+-		list_add(&mnt->mnt_child, &shadows->mnt_child);
+-	} else {
+-		hlist_add_head_rcu(&mnt->mnt_hash,
+-				m_hash(&parent->mnt, mnt->mnt_mountpoint));
+-		list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
+-	}
++	struct mountpoint *old_mp = mnt->mnt_mp;
++	struct dentry *old_mountpoint = mnt->mnt_mountpoint;
++	struct mount *old_parent = mnt->mnt_parent;
++
++	list_del_init(&mnt->mnt_child);
++	hlist_del_init(&mnt->mnt_mp_list);
++	hlist_del_init_rcu(&mnt->mnt_hash);
++
++	attach_mnt(mnt, parent, mp);
++
++	put_mountpoint(old_mp);
++
++	/*
++	 * Safely avoid even the suggestion this code might sleep or
++	 * lock the mount hash by taking advantage of the knowledge that
++	 * mnt_change_mountpoint will not release the final reference
++	 * to a mountpoint.
++	 *
++	 * During mounting, the mount passed in as the parent mount will
++	 * continue to use the old mountpoint and during unmounting, the
++	 * old mountpoint will continue to exist until namespace_unlock,
++	 * which happens well after mnt_change_mountpoint.
++	 */
++	spin_lock(&old_mountpoint->d_lock);
++	old_mountpoint->d_lockref.count--;
++	spin_unlock(&old_mountpoint->d_lock);
++
++	mnt_add_count(old_parent, -1);
+ }
+ 
+ /*
+  * vfsmount lock must be held for write
+  */
+-static void commit_tree(struct mount *mnt, struct mount *shadows)
++static void commit_tree(struct mount *mnt)
+ {
+ 	struct mount *parent = mnt->mnt_parent;
+ 	struct mount *m;
+@@ -929,7 +931,7 @@ static void commit_tree(struct mount *mnt, struct mount *shadows)
+ 	n->mounts += n->pending_mounts;
+ 	n->pending_mounts = 0;
+ 
+-	attach_shadowed(mnt, parent, shadows);
++	__attach_mnt(mnt, parent);
+ 	touch_mnt_namespace(n);
+ }
+ 
+@@ -993,6 +995,21 @@ vfs_kern_mount(struct file_system_type *type, int flags, const char *name, void
+ }
+ EXPORT_SYMBOL_GPL(vfs_kern_mount);
+ 
++struct vfsmount *
++vfs_submount(const struct dentry *mountpoint, struct file_system_type *type,
++	     const char *name, void *data)
++{
++	/* Until it is worked out how to pass the user namespace
++	 * through from the parent mount to the submount don't support
++	 * unprivileged mounts with submounts.
++	 */
++	if (mountpoint->d_sb->s_user_ns != &init_user_ns)
++		return ERR_PTR(-EPERM);
++
++	return vfs_kern_mount(type, MS_SUBMOUNT, name, data);
++}
++EXPORT_SYMBOL_GPL(vfs_submount);
++
+ static struct mount *clone_mnt(struct mount *old, struct dentry *root,
+ 					int flag)
+ {
+@@ -1737,7 +1754,6 @@ struct mount *copy_tree(struct mount *mnt, struct dentry *dentry,
+ 			continue;
+ 
+ 		for (s = r; s; s = next_mnt(s, r)) {
+-			struct mount *t = NULL;
+ 			if (!(flag & CL_COPY_UNBINDABLE) &&
+ 			    IS_MNT_UNBINDABLE(s)) {
+ 				s = skip_mnt_tree(s);
+@@ -1759,14 +1775,7 @@ struct mount *copy_tree(struct mount *mnt, struct dentry *dentry,
+ 				goto out;
+ 			lock_mount_hash();
+ 			list_add_tail(&q->mnt_list, &res->mnt_list);
+-			mnt_set_mountpoint(parent, p->mnt_mp, q);
+-			if (!list_empty(&parent->mnt_mounts)) {
+-				t = list_last_entry(&parent->mnt_mounts,
+-					struct mount, mnt_child);
+-				if (t->mnt_mp != p->mnt_mp)
+-					t = NULL;
+-			}
+-			attach_shadowed(q, parent, t);
++			attach_mnt(q, parent, p->mnt_mp);
+ 			unlock_mount_hash();
+ 		}
+ 	}
+@@ -1967,10 +1976,18 @@ static int attach_recursive_mnt(struct mount *source_mnt,
+ {
+ 	HLIST_HEAD(tree_list);
+ 	struct mnt_namespace *ns = dest_mnt->mnt_ns;
++	struct mountpoint *smp;
+ 	struct mount *child, *p;
+ 	struct hlist_node *n;
+ 	int err;
+ 
++	/* Preallocate a mountpoint in case the new mounts need
++	 * to be tucked under other mounts.
++	 */
++	smp = get_mountpoint(source_mnt->mnt.mnt_root);
++	if (IS_ERR(smp))
++		return PTR_ERR(smp);
++
+ 	/* Is there space to add these mounts to the mount namespace? */
+ 	if (!parent_path) {
+ 		err = count_mounts(ns, source_mnt);
+@@ -1997,16 +2014,19 @@ static int attach_recursive_mnt(struct mount *source_mnt,
+ 		touch_mnt_namespace(source_mnt->mnt_ns);
+ 	} else {
+ 		mnt_set_mountpoint(dest_mnt, dest_mp, source_mnt);
+-		commit_tree(source_mnt, NULL);
++		commit_tree(source_mnt);
+ 	}
+ 
+ 	hlist_for_each_entry_safe(child, n, &tree_list, mnt_hash) {
+ 		struct mount *q;
+ 		hlist_del_init(&child->mnt_hash);
+-		q = __lookup_mnt_last(&child->mnt_parent->mnt,
+-				      child->mnt_mountpoint);
+-		commit_tree(child, q);
++		q = __lookup_mnt(&child->mnt_parent->mnt,
++				 child->mnt_mountpoint);
++		if (q)
++			mnt_change_mountpoint(child, smp, q);
++		commit_tree(child);
+ 	}
++	put_mountpoint(smp);
+ 	unlock_mount_hash();
+ 
+ 	return 0;
+@@ -2021,6 +2041,11 @@ static int attach_recursive_mnt(struct mount *source_mnt,
+ 	cleanup_group_ids(source_mnt, NULL);
+  out:
+ 	ns->pending_mounts = 0;
++
++	read_seqlock_excl(&mount_lock);
++	put_mountpoint(smp);
++	read_sequnlock_excl(&mount_lock);
++
+ 	return err;
+ }
+ 
+@@ -2769,7 +2794,7 @@ long do_mount(const char *dev_name, const char __user *dir_name,
+ 
+ 	flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE | MS_BORN |
+ 		   MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
+-		   MS_STRICTATIME | MS_NOREMOTELOCK);
++		   MS_STRICTATIME | MS_NOREMOTELOCK | MS_SUBMOUNT);
+ 
+ 	if (flags & MS_REMOUNT)
+ 		retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
+diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
+index 5551e8e..e49d831 100644
+--- a/fs/nfs/namespace.c
++++ b/fs/nfs/namespace.c
+@@ -226,7 +226,7 @@ static struct vfsmount *nfs_do_clone_mount(struct nfs_server *server,
+ 					   const char *devname,
+ 					   struct nfs_clone_mount *mountdata)
+ {
+-	return vfs_kern_mount(&nfs_xdev_fs_type, 0, devname, mountdata);
++	return vfs_submount(mountdata->dentry, &nfs_xdev_fs_type, devname, mountdata);
+ }
+ 
+ /**
+diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
+index d211049..d8b040b 100644
+--- a/fs/nfs/nfs4namespace.c
++++ b/fs/nfs/nfs4namespace.c
+@@ -279,7 +279,7 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
+ 				mountdata->hostname,
+ 				mountdata->mnt_path);
+ 
+-		mnt = vfs_kern_mount(&nfs4_referral_fs_type, 0, page, mountdata);
++		mnt = vfs_submount(mountdata->dentry, &nfs4_referral_fs_type, page, mountdata);
+ 		if (!IS_ERR(mnt))
+ 			break;
+ 	}
+diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c
+index c48859f..67c2435 100644
+--- a/fs/orangefs/super.c
++++ b/fs/orangefs/super.c
+@@ -115,6 +115,13 @@ static struct inode *orangefs_alloc_inode(struct super_block *sb)
+ 	return &orangefs_inode->vfs_inode;
+ }
+ 
++static void orangefs_i_callback(struct rcu_head *head)
++{
++	struct inode *inode = container_of(head, struct inode, i_rcu);
++	struct orangefs_inode_s *orangefs_inode = ORANGEFS_I(inode);
++	kmem_cache_free(orangefs_inode_cache, orangefs_inode);
++}
++
+ static void orangefs_destroy_inode(struct inode *inode)
+ {
+ 	struct orangefs_inode_s *orangefs_inode = ORANGEFS_I(inode);
+@@ -123,7 +130,7 @@ static void orangefs_destroy_inode(struct inode *inode)
+ 			"%s: deallocated %p destroying inode %pU\n",
+ 			__func__, orangefs_inode, get_khandle_from_ino(inode));
+ 
+-	kmem_cache_free(orangefs_inode_cache, orangefs_inode);
++	call_rcu(&inode->i_rcu, orangefs_i_callback);
+ }
+ 
+ /*
+diff --git a/fs/pnode.c b/fs/pnode.c
+index 234a9ac..b394ca5 100644
+--- a/fs/pnode.c
++++ b/fs/pnode.c
+@@ -324,6 +324,21 @@ int propagate_mnt(struct mount *dest_mnt, struct mountpoint *dest_mp,
+ 	return ret;
+ }
+ 
++static struct mount *find_topper(struct mount *mnt)
++{
++	/* If there is exactly one mount covering mnt completely return it. */
++	struct mount *child;
++
++	if (!list_is_singular(&mnt->mnt_mounts))
++		return NULL;
++
++	child = list_first_entry(&mnt->mnt_mounts, struct mount, mnt_child);
++	if (child->mnt_mountpoint != mnt->mnt.mnt_root)
++		return NULL;
++
++	return child;
++}
++
+ /*
+  * return true if the refcount is greater than count
+  */
+@@ -344,9 +359,8 @@ static inline int do_refcount_check(struct mount *mnt, int count)
+  */
+ int propagate_mount_busy(struct mount *mnt, int refcnt)
+ {
+-	struct mount *m, *child;
++	struct mount *m, *child, *topper;
+ 	struct mount *parent = mnt->mnt_parent;
+-	int ret = 0;
+ 
+ 	if (mnt == parent)
+ 		return do_refcount_check(mnt, refcnt);
+@@ -361,12 +375,24 @@ int propagate_mount_busy(struct mount *mnt, int refcnt)
+ 
+ 	for (m = propagation_next(parent, parent); m;
+ 	     		m = propagation_next(m, parent)) {
+-		child = __lookup_mnt_last(&m->mnt, mnt->mnt_mountpoint);
+-		if (child && list_empty(&child->mnt_mounts) &&
+-		    (ret = do_refcount_check(child, 1)))
+-			break;
++		int count = 1;
++		child = __lookup_mnt(&m->mnt, mnt->mnt_mountpoint);
++		if (!child)
++			continue;
++
++		/* Is there exactly one mount on the child that covers
++		 * it completely whose reference should be ignored?
++		 */
++		topper = find_topper(child);
++		if (topper)
++			count += 1;
++		else if (!list_empty(&child->mnt_mounts))
++			continue;
++
++		if (do_refcount_check(child, count))
++			return 1;
+ 	}
+-	return ret;
++	return 0;
+ }
+ 
+ /*
+@@ -383,7 +409,7 @@ void propagate_mount_unlock(struct mount *mnt)
+ 
+ 	for (m = propagation_next(parent, parent); m;
+ 			m = propagation_next(m, parent)) {
+-		child = __lookup_mnt_last(&m->mnt, mnt->mnt_mountpoint);
++		child = __lookup_mnt(&m->mnt, mnt->mnt_mountpoint);
+ 		if (child)
+ 			child->mnt.mnt_flags &= ~MNT_LOCKED;
+ 	}
+@@ -401,9 +427,11 @@ static void mark_umount_candidates(struct mount *mnt)
+ 
+ 	for (m = propagation_next(parent, parent); m;
+ 			m = propagation_next(m, parent)) {
+-		struct mount *child = __lookup_mnt_last(&m->mnt,
++		struct mount *child = __lookup_mnt(&m->mnt,
+ 						mnt->mnt_mountpoint);
+-		if (child && (!IS_MNT_LOCKED(child) || IS_MNT_MARKED(m))) {
++		if (!child || (child->mnt.mnt_flags & MNT_UMOUNT))
++			continue;
++		if (!IS_MNT_LOCKED(child) || IS_MNT_MARKED(m)) {
+ 			SET_MNT_MARK(child);
+ 		}
+ 	}
+@@ -422,8 +450,8 @@ static void __propagate_umount(struct mount *mnt)
+ 
+ 	for (m = propagation_next(parent, parent); m;
+ 			m = propagation_next(m, parent)) {
+-
+-		struct mount *child = __lookup_mnt_last(&m->mnt,
++		struct mount *topper;
++		struct mount *child = __lookup_mnt(&m->mnt,
+ 						mnt->mnt_mountpoint);
+ 		/*
+ 		 * umount the child only if the child has no children
+@@ -432,6 +460,15 @@ static void __propagate_umount(struct mount *mnt)
+ 		if (!child || !IS_MNT_MARKED(child))
+ 			continue;
+ 		CLEAR_MNT_MARK(child);
++
++		/* If there is exactly one mount covering all of child
++		 * replace child with that mount.
++		 */
++		topper = find_topper(child);
++		if (topper)
++			mnt_change_mountpoint(child->mnt_parent, child->mnt_mp,
++					      topper);
++
+ 		if (list_empty(&child->mnt_mounts)) {
+ 			list_del_init(&child->mnt_child);
+ 			child->mnt.mnt_flags |= MNT_UMOUNT;
+diff --git a/fs/pnode.h b/fs/pnode.h
+index 550f5a8..dc87e65 100644
+--- a/fs/pnode.h
++++ b/fs/pnode.h
+@@ -49,6 +49,8 @@ int get_dominating_id(struct mount *mnt, const struct path *root);
+ unsigned int mnt_get_count(struct mount *mnt);
+ void mnt_set_mountpoint(struct mount *, struct mountpoint *,
+ 			struct mount *);
++void mnt_change_mountpoint(struct mount *parent, struct mountpoint *mp,
++			   struct mount *mnt);
+ struct mount *copy_tree(struct mount *, struct dentry *, int);
+ bool is_path_reachable(struct mount *, struct dentry *,
+ 			 const struct path *root);
+diff --git a/fs/super.c b/fs/super.c
+index c183835..1058bf3 100644
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -470,7 +470,7 @@ struct super_block *sget_userns(struct file_system_type *type,
+ 	struct super_block *old;
+ 	int err;
+ 
+-	if (!(flags & MS_KERNMOUNT) &&
++	if (!(flags & (MS_KERNMOUNT|MS_SUBMOUNT)) &&
+ 	    !(type->fs_flags & FS_USERNS_MOUNT) &&
+ 	    !capable(CAP_SYS_ADMIN))
+ 		return ERR_PTR(-EPERM);
+@@ -500,7 +500,7 @@ struct super_block *sget_userns(struct file_system_type *type,
+ 	}
+ 	if (!s) {
+ 		spin_unlock(&sb_lock);
+-		s = alloc_super(type, flags, user_ns);
++		s = alloc_super(type, (flags & ~MS_SUBMOUNT), user_ns);
+ 		if (!s)
+ 			return ERR_PTR(-ENOMEM);
+ 		goto retry;
+@@ -541,8 +541,15 @@ struct super_block *sget(struct file_system_type *type,
+ {
+ 	struct user_namespace *user_ns = current_user_ns();
+ 
++	/* We don't yet pass the user namespace of the parent
++	 * mount through to here so always use &init_user_ns
++	 * until that changes.
++	 */
++	if (flags & MS_SUBMOUNT)
++		user_ns = &init_user_ns;
++
+ 	/* Ensure the requestor has permissions over the target filesystem */
+-	if (!(flags & MS_KERNMOUNT) && !ns_capable(user_ns, CAP_SYS_ADMIN))
++	if (!(flags & (MS_KERNMOUNT|MS_SUBMOUNT)) && !ns_capable(user_ns, CAP_SYS_ADMIN))
+ 		return ERR_PTR(-EPERM);
+ 
+ 	return sget_userns(type, test, set, flags, user_ns, data);
+diff --git a/include/linux/ceph/osdmap.h b/include/linux/ceph/osdmap.h
+index 9a90417..4129066 100644
+--- a/include/linux/ceph/osdmap.h
++++ b/include/linux/ceph/osdmap.h
+@@ -57,7 +57,7 @@ static inline bool ceph_can_shift_osds(struct ceph_pg_pool_info *pool)
+ 	case CEPH_POOL_TYPE_EC:
+ 		return false;
+ 	default:
+-		BUG_ON(1);
++		BUG();
+ 	}
+ }
+ 
+diff --git a/include/linux/debugfs.h b/include/linux/debugfs.h
+index 1b413a9..b20a094 100644
+--- a/include/linux/debugfs.h
++++ b/include/linux/debugfs.h
+@@ -96,9 +96,10 @@ struct dentry *debugfs_create_dir(const char *name, struct dentry *parent);
+ struct dentry *debugfs_create_symlink(const char *name, struct dentry *parent,
+ 				      const char *dest);
+ 
++typedef struct vfsmount *(*debugfs_automount_t)(struct dentry *, void *);
+ struct dentry *debugfs_create_automount(const char *name,
+ 					struct dentry *parent,
+-					struct vfsmount *(*f)(void *),
++					debugfs_automount_t f,
+ 					void *data);
+ 
+ void debugfs_remove(struct dentry *dentry);
+diff --git a/include/linux/libnvdimm.h b/include/linux/libnvdimm.h
+index 8458c53..77e7af3 100644
+--- a/include/linux/libnvdimm.h
++++ b/include/linux/libnvdimm.h
+@@ -70,6 +70,8 @@ struct nd_cmd_desc {
+ 
+ struct nd_interleave_set {
+ 	u64 cookie;
++	/* compatibility with initial buggy Linux implementation */
++	u64 altcookie;
+ };
+ 
+ struct nd_mapping_desc {
+diff --git a/include/linux/lockd/lockd.h b/include/linux/lockd/lockd.h
+index c153738..b37dee3 100644
+--- a/include/linux/lockd/lockd.h
++++ b/include/linux/lockd/lockd.h
+@@ -355,7 +355,8 @@ static inline int nlm_privileged_requester(const struct svc_rqst *rqstp)
+ static inline int nlm_compare_locks(const struct file_lock *fl1,
+ 				    const struct file_lock *fl2)
+ {
+-	return	fl1->fl_pid   == fl2->fl_pid
++	return file_inode(fl1->fl_file) == file_inode(fl2->fl_file)
++	     && fl1->fl_pid   == fl2->fl_pid
+ 	     && fl1->fl_owner == fl2->fl_owner
+ 	     && fl1->fl_start == fl2->fl_start
+ 	     && fl1->fl_end   == fl2->fl_end
+diff --git a/include/linux/mount.h b/include/linux/mount.h
+index 1172cce..e0f3a82 100644
+--- a/include/linux/mount.h
++++ b/include/linux/mount.h
+@@ -90,6 +90,9 @@ struct file_system_type;
+ extern struct vfsmount *vfs_kern_mount(struct file_system_type *type,
+ 				      int flags, const char *name,
+ 				      void *data);
++extern struct vfsmount *vfs_submount(const struct dentry *mountpoint,
++				     struct file_system_type *type,
++				     const char *name, void *data);
+ 
+ extern void mnt_set_expiry(struct vfsmount *mnt, struct list_head *expiry_list);
+ extern void mark_mounts_for_expiry(struct list_head *mounts);
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index 48bc1ac..6233e8f 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -732,6 +732,7 @@ struct se_lun {
+ 	struct config_group	lun_group;
+ 	struct se_port_stat_grps port_stat_grps;
+ 	struct completion	lun_ref_comp;
++	struct completion	lun_shutdown_comp;
+ 	struct percpu_ref	lun_ref;
+ 	struct list_head	lun_dev_link;
+ 	struct hlist_node	link;
+diff --git a/include/uapi/linux/fs.h b/include/uapi/linux/fs.h
+index acb2b61..4749955 100644
+--- a/include/uapi/linux/fs.h
++++ b/include/uapi/linux/fs.h
+@@ -132,6 +132,7 @@ struct inodes_stat_t {
+ #define MS_LAZYTIME	(1<<25) /* Update the on-disk [acm]times lazily */
+ 
+ /* These sb flags are internal to the kernel */
++#define MS_SUBMOUNT     (1<<26)
+ #define MS_NOREMOTELOCK	(1<<27)
+ #define MS_NOSEC	(1<<28)
+ #define MS_BORN		(1<<29)
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 8696ce6..90b66ed 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -7241,7 +7241,7 @@ init_tracer_tracefs(struct trace_array *tr, struct dentry *d_tracer)
+ 	ftrace_init_tracefs(tr, d_tracer);
+ }
+ 
+-static struct vfsmount *trace_automount(void *ingore)
++static struct vfsmount *trace_automount(struct dentry *mntpt, void *ingore)
+ {
+ 	struct vfsmount *mnt;
+ 	struct file_system_type *type;
+@@ -7254,7 +7254,7 @@ static struct vfsmount *trace_automount(void *ingore)
+ 	type = get_fs_type("tracefs");
+ 	if (!type)
+ 		return NULL;
+-	mnt = vfs_kern_mount(type, 0, "tracefs", NULL);
++	mnt = vfs_submount(mntpt, type, "tracefs", NULL);
+ 	put_filesystem(type);
+ 	if (IS_ERR(mnt))
+ 		return NULL;
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 4c6ade5..0de2669 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -4139,17 +4139,22 @@ static void free_mem_cgroup_per_node_info(struct mem_cgroup *memcg, int node)
+ 	kfree(memcg->nodeinfo[node]);
+ }
+ 
+-static void mem_cgroup_free(struct mem_cgroup *memcg)
++static void __mem_cgroup_free(struct mem_cgroup *memcg)
+ {
+ 	int node;
+ 
+-	memcg_wb_domain_exit(memcg);
+ 	for_each_node(node)
+ 		free_mem_cgroup_per_node_info(memcg, node);
+ 	free_percpu(memcg->stat);
+ 	kfree(memcg);
+ }
+ 
++static void mem_cgroup_free(struct mem_cgroup *memcg)
++{
++	memcg_wb_domain_exit(memcg);
++	__mem_cgroup_free(memcg);
++}
++
+ static struct mem_cgroup *mem_cgroup_alloc(void)
+ {
+ 	struct mem_cgroup *memcg;
+@@ -4200,7 +4205,7 @@ static struct mem_cgroup *mem_cgroup_alloc(void)
+ fail:
+ 	if (memcg->id.id > 0)
+ 		idr_remove(&mem_cgroup_idr, memcg->id.id);
+-	mem_cgroup_free(memcg);
++	__mem_cgroup_free(memcg);
+ 	return NULL;
+ }
+ 
+diff --git a/mm/mlock.c b/mm/mlock.c
+index cdbed8a..665ab75 100644
+--- a/mm/mlock.c
++++ b/mm/mlock.c
+@@ -441,7 +441,7 @@ void munlock_vma_pages_range(struct vm_area_struct *vma,
+ 
+ 	while (start < end) {
+ 		struct page *page;
+-		unsigned int page_mask;
++		unsigned int page_mask = 0;
+ 		unsigned long page_increm;
+ 		struct pagevec pvec;
+ 		struct zone *zone;
+@@ -455,8 +455,7 @@ void munlock_vma_pages_range(struct vm_area_struct *vma,
+ 		 * suits munlock very well (and if somehow an abnormal page
+ 		 * has sneaked into the range, we won't oops here: great).
+ 		 */
+-		page = follow_page_mask(vma, start, FOLL_GET | FOLL_DUMP,
+-				&page_mask);
++		page = follow_page(vma, start, FOLL_GET | FOLL_DUMP);
+ 
+ 		if (page && !IS_ERR(page)) {
+ 			if (PageTransTail(page)) {
+@@ -467,8 +466,8 @@ void munlock_vma_pages_range(struct vm_area_struct *vma,
+ 				/*
+ 				 * Any THP page found by follow_page_mask() may
+ 				 * have gotten split before reaching
+-				 * munlock_vma_page(), so we need to recompute
+-				 * the page_mask here.
++				 * munlock_vma_page(), so we need to compute
++				 * the page_mask here instead.
+ 				 */
+ 				page_mask = munlock_vma_page(page);
+ 				unlock_page(page);
+diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
+index 3b5fd41..58ad23a 100644
+--- a/net/mac80211/agg-rx.c
++++ b/net/mac80211/agg-rx.c
+@@ -398,6 +398,7 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
+ 	tid_agg_rx->timeout = timeout;
+ 	tid_agg_rx->stored_mpdu_num = 0;
+ 	tid_agg_rx->auto_seq = auto_seq;
++	tid_agg_rx->started = false;
+ 	tid_agg_rx->reorder_buf_filtered = 0;
+ 	status = WLAN_STATUS_SUCCESS;
+ 
+diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
+index 28a3a09..76a8bcd 100644
+--- a/net/mac80211/pm.c
++++ b/net/mac80211/pm.c
+@@ -168,6 +168,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
+ 			break;
+ 		}
+ 
++		flush_delayed_work(&sdata->dec_tailroom_needed_wk);
+ 		drv_remove_interface(local, sdata);
+ 	}
+ 
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 2384b4a..a697ddf 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4,7 +4,7 @@
+  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
+  * Copyright 2007-2010	Johannes Berg <johannes@sipsolutions.net>
+  * Copyright 2013-2014  Intel Mobile Communications GmbH
+- * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
++ * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of the GNU General Public License version 2 as
+@@ -1034,6 +1034,18 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata
+ 	buf_size = tid_agg_rx->buf_size;
+ 	head_seq_num = tid_agg_rx->head_seq_num;
+ 
++	/*
++	 * If the current MPDU's SN is smaller than the SSN, it shouldn't
++	 * be reordered.
++	 */
++	if (unlikely(!tid_agg_rx->started)) {
++		if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
++			ret = false;
++			goto out;
++		}
++		tid_agg_rx->started = true;
++	}
++
+ 	/* frame with out of date sequence number */
+ 	if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
+ 		dev_kfree_skb(skb);
+@@ -4080,15 +4092,17 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
+ 		     ieee80211_is_beacon(hdr->frame_control)))
+ 		ieee80211_scan_rx(local, skb);
+ 
+-	if (pubsta) {
+-		rx.sta = container_of(pubsta, struct sta_info, sta);
+-		rx.sdata = rx.sta->sdata;
+-		if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
+-			return;
+-		goto out;
+-	} else if (ieee80211_is_data(fc)) {
++	if (ieee80211_is_data(fc)) {
+ 		struct sta_info *sta, *prev_sta;
+ 
++		if (pubsta) {
++			rx.sta = container_of(pubsta, struct sta_info, sta);
++			rx.sdata = rx.sta->sdata;
++			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
++				return;
++			goto out;
++		}
++
+ 		prev_sta = NULL;
+ 
+ 		for_each_sta_info(local, hdr->addr2, sta, tmp) {
+diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
+index dd06ef0..15599c7 100644
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -189,6 +189,7 @@ struct tid_ampdu_tx {
+  * @auto_seq: used for offloaded BA sessions to automatically pick head_seq_and
+  *	and ssn.
+  * @removed: this session is removed (but might have been found due to RCU)
++ * @started: this session has started (head ssn or higher was received)
+  *
+  * This structure's lifetime is managed by RCU, assignments to
+  * the array holding it must hold the aggregation mutex.
+@@ -212,8 +213,9 @@ struct tid_ampdu_rx {
+ 	u16 ssn;
+ 	u16 buf_size;
+ 	u16 timeout;
+-	bool auto_seq;
+-	bool removed;
++	u8 auto_seq:1,
++	   removed:1,
++	   started:1;
+ };
+ 
+ /**
+diff --git a/net/mac80211/status.c b/net/mac80211/status.c
+index ddf71c6..ad37b4e 100644
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -51,7 +51,8 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
+ 	struct ieee80211_hdr *hdr = (void *)skb->data;
+ 	int ac;
+ 
+-	if (info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER) {
++	if (info->flags & (IEEE80211_TX_CTL_NO_PS_BUFFER |
++			   IEEE80211_TX_CTL_AMPDU)) {
+ 		ieee80211_free_txskb(&local->hw, skb);
+ 		return;
+ 	}
+diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
+index d08e214..223d88e 100755
+--- a/tools/testing/ktest/ktest.pl
++++ b/tools/testing/ktest/ktest.pl
+@@ -2629,7 +2629,7 @@ sub do_run_test {
+     }
+ 
+     waitpid $child_pid, 0;
+-    $child_exit = $?;
++    $child_exit = $? >> 8;
+ 
+     my $end_time = time;
+     $test_time = $end_time - $start_time;
diff --git a/4.9.14/4420_grsecurity-3.1-4.9.14-201703121245.patch b/4.9.15/4420_grsecurity-3.1-4.9.15-201703150049.patch
index 907f037..71528ee 100644
--- a/4.9.14/4420_grsecurity-3.1-4.9.14-201703121245.patch
+++ b/4.9.15/4420_grsecurity-3.1-4.9.15-201703150049.patch
@@ -419,7 +419,7 @@ index 3d0ae15..84e5412 100644
        cmd_syscalls = $(CONFIG_SHELL) $< $(CC) $(c_flags) $(missing_syscalls_flags)
  
 diff --git a/Makefile b/Makefile
-index 5e7706e..e0bcf96 100644
+index 03df4fc..e57ff003 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -302,7 +302,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -27476,7 +27476,7 @@ index ad6f5eb0..1b4909d 100644
  
  #ifdef CONFIG_COMPAT
 diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
-index 6fa8594..c5b8ce1 100644
+index fc5abff..58c5feb 100644
 --- a/arch/x86/include/asm/tlbflush.h
 +++ b/arch/x86/include/asm/tlbflush.h
 @@ -89,7 +89,9 @@ static inline void cr4_set_bits(unsigned long mask)
@@ -36116,7 +36116,7 @@ index 8ca1eca..fff3699b 100644
  
  	local_irq_disable();
 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index 64774f4..4888061 100644
+index 69b8f8a..0cf39f5 100644
 --- a/arch/x86/kvm/vmx.c
 +++ b/arch/x86/kvm/vmx.c
 @@ -1675,14 +1675,14 @@ static __always_inline void vmcs_writel(unsigned long field, unsigned long value
@@ -40903,10 +40903,10 @@ index 9f72ca3..a076e4a 100644
 +	return ret ? -EFAULT : 0;
 +}
 diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
-index 0d4fb3e..0ae587e 100644
+index 1680768..7b7d958 100644
 --- a/arch/x86/mm/gup.c
 +++ b/arch/x86/mm/gup.c
-@@ -313,7 +313,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
+@@ -317,7 +317,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
  	addr = start;
  	len = (unsigned long) nr_pages << PAGE_SHIFT;
  	end = start + len;
@@ -40915,7 +40915,7 @@ index 0d4fb3e..0ae587e 100644
  					(void __user *)start, len)))
  		return 0;
  
-@@ -389,6 +389,10 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write,
+@@ -393,6 +393,10 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write,
  		goto slow_irqon;
  #endif
  
@@ -53143,10 +53143,10 @@ index 9672b57..d25a507c 100644
  
  	imx_drm_crtc = kzalloc(sizeof(*imx_drm_crtc), GFP_KERNEL);
 diff --git a/drivers/gpu/drm/imx/imx-tve.c b/drivers/gpu/drm/imx/imx-tve.c
-index 8fc0888..6dad243 100644
+index 89cf009..1d14e38 100644
 --- a/drivers/gpu/drm/imx/imx-tve.c
 +++ b/drivers/gpu/drm/imx/imx-tve.c
-@@ -252,7 +252,7 @@ static int imx_tve_connector_get_modes(struct drm_connector *connector)
+@@ -254,7 +254,7 @@ static int imx_tve_connector_get_modes(struct drm_connector *connector)
  	return ret;
  }
  
@@ -55138,7 +55138,7 @@ index 80482ac..bf693e5 100644
  
  static int virtio_gpu_init_mem_type(struct ttm_bo_device *bdev, uint32_t type,
 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
-index 1e59a48..d5f230b 100644
+index 59ff419..34b8477 100644
 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
 @@ -439,7 +439,7 @@ struct vmw_private {
@@ -55352,7 +55352,7 @@ index be34547..df73ac5 100644
  	packetlen_aligned = ALIGN(packetlen, sizeof(u64));
  
 diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
-index 6e49a4d..e4b9aa2 100644
+index e0a8216..e4b9aa2 100644
 --- a/drivers/hv/hv.c
 +++ b/drivers/hv/hv.c
 @@ -183,6 +183,7 @@ static struct clocksource hyperv_cs_tsc = {
@@ -55375,7 +55375,7 @@ index 6e49a4d..e4b9aa2 100644
  	/* See if the hypercall page is already set */
  	rdmsrl(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64);
  
--	virtaddr = __vmalloc(PAGE_SIZE, GFP_KERNEL, PAGE_KERNEL_EXEC);
+-	virtaddr = __vmalloc(PAGE_SIZE, GFP_KERNEL, PAGE_KERNEL_RX);
 -
 -	if (!virtaddr)
 -		goto cleanup;
@@ -57334,10 +57334,10 @@ index cac1d52..29bb903 100644
  	int			need_req_skb;
  
 diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
-index b58d9dc..09d2d64 100644
+index 3ef7b8f..52f1d96 100644
 --- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
 +++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
-@@ -1029,7 +1029,7 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
+@@ -1034,7 +1034,7 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
  	spin_unlock_irqrestore(&priv->lock, flags);
  }
  
@@ -68462,7 +68462,7 @@ index 707bc46..14bf9a5 100644
  	struct mvneta_port *pp = netdev_priv(dev);
  	u16 txq_id = skb_get_queue_mapping(skb);
 diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
-index 930c816..1686d31 100644
+index 0a4e81a..fb7eb36 100644
 --- a/drivers/net/ethernet/marvell/mvpp2.c
 +++ b/drivers/net/ethernet/marvell/mvpp2.c
 @@ -5237,7 +5237,7 @@ static int mvpp2_tx_frag_process(struct mvpp2_port *port, struct sk_buff *skb,
@@ -84743,291 +84743,6 @@ index 54cab59..3c05ac4 100644
  	tty_port_tty_set(port, tty);
  
  	dlci->modem_rx = 0;
-diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
-index a7fa016..6d1e2f7 100644
---- a/drivers/tty/n_hdlc.c
-+++ b/drivers/tty/n_hdlc.c
-@@ -114,7 +114,7 @@
- #define DEFAULT_TX_BUF_COUNT 3
- 
- struct n_hdlc_buf {
--	struct n_hdlc_buf *link;
-+	struct list_head  list_item;
- 	int		  count;
- 	char		  buf[1];
- };
-@@ -122,8 +122,7 @@ struct n_hdlc_buf {
- #define	N_HDLC_BUF_SIZE	(sizeof(struct n_hdlc_buf) + maxframe)
- 
- struct n_hdlc_buf_list {
--	struct n_hdlc_buf *head;
--	struct n_hdlc_buf *tail;
-+	struct list_head  list;
- 	int		  count;
- 	spinlock_t	  spinlock;
- };
-@@ -136,7 +135,6 @@ struct n_hdlc_buf_list {
-  * @backup_tty - TTY to use if tty gets closed
-  * @tbusy - reentrancy flag for tx wakeup code
-  * @woke_up - FIXME: describe this field
-- * @tbuf - currently transmitting tx buffer
-  * @tx_buf_list - list of pending transmit frame buffers
-  * @rx_buf_list - list of received frame buffers
-  * @tx_free_buf_list - list unused transmit frame buffers
-@@ -149,7 +147,6 @@ struct n_hdlc {
- 	struct tty_struct	*backup_tty;
- 	int			tbusy;
- 	int			woke_up;
--	struct n_hdlc_buf	*tbuf;
- 	struct n_hdlc_buf_list	tx_buf_list;
- 	struct n_hdlc_buf_list	rx_buf_list;
- 	struct n_hdlc_buf_list	tx_free_buf_list;
-@@ -159,6 +156,8 @@ struct n_hdlc {
- /*
-  * HDLC buffer list manipulation functions
-  */
-+static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list,
-+						struct n_hdlc_buf *buf);
- static void n_hdlc_buf_put(struct n_hdlc_buf_list *list,
- 			   struct n_hdlc_buf *buf);
- static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *list);
-@@ -208,16 +207,9 @@ static void flush_tx_queue(struct tty_struct *tty)
- {
- 	struct n_hdlc *n_hdlc = tty2n_hdlc(tty);
- 	struct n_hdlc_buf *buf;
--	unsigned long flags;
- 
- 	while ((buf = n_hdlc_buf_get(&n_hdlc->tx_buf_list)))
- 		n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, buf);
-- 	spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock, flags);
--	if (n_hdlc->tbuf) {
--		n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, n_hdlc->tbuf);
--		n_hdlc->tbuf = NULL;
--	}
--	spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags);
- }
- 
- static struct tty_ldisc_ops n_hdlc_ldisc = {
-@@ -283,7 +275,6 @@ static void n_hdlc_release(struct n_hdlc *n_hdlc)
- 		} else
- 			break;
- 	}
--	kfree(n_hdlc->tbuf);
- 	kfree(n_hdlc);
- 	
- }	/* end of n_hdlc_release() */
-@@ -402,13 +393,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
- 	n_hdlc->woke_up = 0;
- 	spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags);
- 
--	/* get current transmit buffer or get new transmit */
--	/* buffer from list of pending transmit buffers */
--		
--	tbuf = n_hdlc->tbuf;
--	if (!tbuf)
--		tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list);
--		
-+	tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list);
- 	while (tbuf) {
- 		if (debuglevel >= DEBUG_LEVEL_INFO)	
- 			printk("%s(%d)sending frame %p, count=%d\n",
-@@ -420,7 +405,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
- 
- 		/* rollback was possible and has been done */
- 		if (actual == -ERESTARTSYS) {
--			n_hdlc->tbuf = tbuf;
-+			n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf);
- 			break;
- 		}
- 		/* if transmit error, throw frame away by */
-@@ -435,10 +420,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
- 					
- 			/* free current transmit buffer */
- 			n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, tbuf);
--			
--			/* this tx buffer is done */
--			n_hdlc->tbuf = NULL;
--			
-+
- 			/* wait up sleeping writers */
- 			wake_up_interruptible(&tty->write_wait);
- 	
-@@ -448,10 +430,12 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
- 			if (debuglevel >= DEBUG_LEVEL_INFO)	
- 				printk("%s(%d)frame %p pending\n",
- 					__FILE__,__LINE__,tbuf);
--					
--			/* buffer not accepted by driver */
--			/* set this buffer as pending buffer */
--			n_hdlc->tbuf = tbuf;
-+
-+			/*
-+			 * the buffer was not accepted by driver,
-+			 * return it back into tx queue
-+			 */
-+			n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf);
- 			break;
- 		}
- 	}
-@@ -749,7 +733,8 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
- 	int error = 0;
- 	int count;
- 	unsigned long flags;
--	
-+	struct n_hdlc_buf *buf = NULL;
-+
- 	if (debuglevel >= DEBUG_LEVEL_INFO)	
- 		printk("%s(%d)n_hdlc_tty_ioctl() called %d\n",
- 			__FILE__,__LINE__,cmd);
-@@ -763,8 +748,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
- 		/* report count of read data available */
- 		/* in next available frame (if any) */
- 		spin_lock_irqsave(&n_hdlc->rx_buf_list.spinlock,flags);
--		if (n_hdlc->rx_buf_list.head)
--			count = n_hdlc->rx_buf_list.head->count;
-+		buf = list_first_entry_or_null(&n_hdlc->rx_buf_list.list,
-+						struct n_hdlc_buf, list_item);
-+		if (buf)
-+			count = buf->count;
- 		else
- 			count = 0;
- 		spin_unlock_irqrestore(&n_hdlc->rx_buf_list.spinlock,flags);
-@@ -776,8 +763,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
- 		count = tty_chars_in_buffer(tty);
- 		/* add size of next output frame in queue */
- 		spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock,flags);
--		if (n_hdlc->tx_buf_list.head)
--			count += n_hdlc->tx_buf_list.head->count;
-+		buf = list_first_entry_or_null(&n_hdlc->tx_buf_list.list,
-+						struct n_hdlc_buf, list_item);
-+		if (buf)
-+			count += buf->count;
- 		spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock,flags);
- 		error = put_user(count, (int __user *)arg);
- 		break;
-@@ -825,14 +814,14 @@ static unsigned int n_hdlc_tty_poll(struct tty_struct *tty, struct file *filp,
- 		poll_wait(filp, &tty->write_wait, wait);
- 
- 		/* set bits for operations that won't block */
--		if (n_hdlc->rx_buf_list.head)
-+		if (!list_empty(&n_hdlc->rx_buf_list.list))
- 			mask |= POLLIN | POLLRDNORM;	/* readable */
- 		if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
- 			mask |= POLLHUP;
- 		if (tty_hung_up_p(filp))
- 			mask |= POLLHUP;
- 		if (!tty_is_writelocked(tty) &&
--				n_hdlc->tx_free_buf_list.head)
-+				!list_empty(&n_hdlc->tx_free_buf_list.list))
- 			mask |= POLLOUT | POLLWRNORM;	/* writable */
- 	}
- 	return mask;
-@@ -856,7 +845,12 @@ static struct n_hdlc *n_hdlc_alloc(void)
- 	spin_lock_init(&n_hdlc->tx_free_buf_list.spinlock);
- 	spin_lock_init(&n_hdlc->rx_buf_list.spinlock);
- 	spin_lock_init(&n_hdlc->tx_buf_list.spinlock);
--	
-+
-+	INIT_LIST_HEAD(&n_hdlc->rx_free_buf_list.list);
-+	INIT_LIST_HEAD(&n_hdlc->tx_free_buf_list.list);
-+	INIT_LIST_HEAD(&n_hdlc->rx_buf_list.list);
-+	INIT_LIST_HEAD(&n_hdlc->tx_buf_list.list);
-+
- 	/* allocate free rx buffer list */
- 	for(i=0;i<DEFAULT_RX_BUF_COUNT;i++) {
- 		buf = kmalloc(N_HDLC_BUF_SIZE, GFP_KERNEL);
-@@ -884,53 +878,65 @@ static struct n_hdlc *n_hdlc_alloc(void)
- }	/* end of n_hdlc_alloc() */
- 
- /**
-+ * n_hdlc_buf_return - put the HDLC buffer after the head of the specified list
-+ * @buf_list - pointer to the buffer list
-+ * @buf - pointer to the buffer
-+ */
-+static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list,
-+						struct n_hdlc_buf *buf)
-+{
-+	unsigned long flags;
-+
-+	spin_lock_irqsave(&buf_list->spinlock, flags);
-+
-+	list_add(&buf->list_item, &buf_list->list);
-+	buf_list->count++;
-+
-+	spin_unlock_irqrestore(&buf_list->spinlock, flags);
-+}
-+
-+/**
-  * n_hdlc_buf_put - add specified HDLC buffer to tail of specified list
-- * @list - pointer to buffer list
-+ * @buf_list - pointer to buffer list
-  * @buf	- pointer to buffer
-  */
--static void n_hdlc_buf_put(struct n_hdlc_buf_list *list,
-+static void n_hdlc_buf_put(struct n_hdlc_buf_list *buf_list,
- 			   struct n_hdlc_buf *buf)
- {
- 	unsigned long flags;
--	spin_lock_irqsave(&list->spinlock,flags);
--	
--	buf->link=NULL;
--	if (list->tail)
--		list->tail->link = buf;
--	else
--		list->head = buf;
--	list->tail = buf;
--	(list->count)++;
--	
--	spin_unlock_irqrestore(&list->spinlock,flags);
--	
-+
-+	spin_lock_irqsave(&buf_list->spinlock, flags);
-+
-+	list_add_tail(&buf->list_item, &buf_list->list);
-+	buf_list->count++;
-+
-+	spin_unlock_irqrestore(&buf_list->spinlock, flags);
- }	/* end of n_hdlc_buf_put() */
- 
- /**
-  * n_hdlc_buf_get - remove and return an HDLC buffer from list
-- * @list - pointer to HDLC buffer list
-+ * @buf_list - pointer to HDLC buffer list
-  * 
-  * Remove and return an HDLC buffer from the head of the specified HDLC buffer
-  * list.
-  * Returns a pointer to HDLC buffer if available, otherwise %NULL.
-  */
--static struct n_hdlc_buf* n_hdlc_buf_get(struct n_hdlc_buf_list *list)
-+static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *buf_list)
- {
- 	unsigned long flags;
- 	struct n_hdlc_buf *buf;
--	spin_lock_irqsave(&list->spinlock,flags);
--	
--	buf = list->head;
-+
-+	spin_lock_irqsave(&buf_list->spinlock, flags);
-+
-+	buf = list_first_entry_or_null(&buf_list->list,
-+						struct n_hdlc_buf, list_item);
- 	if (buf) {
--		list->head = buf->link;
--		(list->count)--;
-+		list_del(&buf->list_item);
-+		buf_list->count--;
- 	}
--	if (!list->head)
--		list->tail = NULL;
--	
--	spin_unlock_irqrestore(&list->spinlock,flags);
-+
-+	spin_unlock_irqrestore(&buf_list->spinlock, flags);
- 	return buf;
--	
- }	/* end of n_hdlc_buf_get() */
- 
- static char hdlc_banner[] __initdata =
 diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
 index bdf0e6e..ea92f7e 100644
 --- a/drivers/tty/n_tty.c
@@ -85225,10 +84940,10 @@ index e8819aa..33d2176 100644
  	if (share_irqs)
  		irqflag = IRQF_SHARED;
 diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
-index b98c157..33d1d98e 100644
+index 4d09bd4..5c7839e 100644
 --- a/drivers/tty/serial/8250/8250_pci.c
 +++ b/drivers/tty/serial/8250/8250_pci.c
-@@ -5569,7 +5569,7 @@ static struct pci_device_id serial_pci_tbl[] = {
+@@ -5582,7 +5582,7 @@ static struct pci_device_id serial_pci_tbl[] = {
  };
  
  static pci_ers_result_t serial8250_io_error_detected(struct pci_dev *dev,
@@ -103658,7 +103373,7 @@ index c902b3d..d3cd556 100644
  			goto out_sig;
  		if (offset > inode->i_sb->s_maxbytes)
 diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
-index e44271d..0fdc215 100644
+index 5db6c8d..6e7193a 100644
 --- a/fs/autofs4/waitq.c
 +++ b/fs/autofs4/waitq.c
 @@ -56,7 +56,7 @@ static int autofs4_write(struct autofs_sb_info *sbi,
@@ -106831,7 +106546,7 @@ index 354e2ab..cd4ee7b 100644
  			       size_t count, loff_t *ppos)
  {
 diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
-index f17fcf8..2529cb0 100644
+index 1e30f74..8925fad 100644
 --- a/fs/debugfs/inode.c
 +++ b/fs/debugfs/inode.c
 @@ -253,6 +253,10 @@ static struct dentry *start_creating(const char *name, struct dentry *parent)
@@ -111663,7 +111378,7 @@ index 5751082..7619dac 100644
  
  module_init(logfs_init);
 diff --git a/fs/mount.h b/fs/mount.h
-index d2e25d7..20d94ba 100644
+index d8295f2..3e26989 100644
 --- a/fs/mount.h
 +++ b/fs/mount.h
 @@ -16,7 +16,7 @@ struct mnt_namespace {
@@ -111685,7 +111400,7 @@ index d2e25d7..20d94ba 100644
  #define MNT_NS_INTERNAL ERR_PTR(-EINVAL) /* distinct from any mnt_namespace */
  
 diff --git a/fs/namei.c b/fs/namei.c
-index 5b4eed2..ad403ae 100644
+index d5e5140..32d72d1 100644
 --- a/fs/namei.c
 +++ b/fs/namei.c
 @@ -330,6 +330,8 @@ static int acl_permission_check(struct inode *inode, int mask)
@@ -111881,7 +111596,7 @@ index 5b4eed2..ad403ae 100644
  	nd->last_type = LAST_BIND;
  	res = inode->i_link;
  	if (!res) {
-@@ -1717,6 +1807,23 @@ static int pick_link(struct nameidata *nd, struct path *link,
+@@ -1714,6 +1804,23 @@ static int pick_link(struct nameidata *nd, struct path *link,
  		}
  	}
  
@@ -111905,7 +111620,7 @@ index 5b4eed2..ad403ae 100644
  	last = nd->stack + nd->depth++;
  	last->link = *link;
  	clear_delayed_call(&last->done);
-@@ -1931,7 +2038,7 @@ u64 hashlen_string(const void *salt, const char *name)
+@@ -1928,7 +2035,7 @@ u64 hashlen_string(const void *salt, const char *name)
  {
  	unsigned long a = 0, x = 0, y = (unsigned long)salt;
  	unsigned long adata, mask, len;
@@ -111914,7 +111629,7 @@ index 5b4eed2..ad403ae 100644
  
  	len = 0;
  	goto inside;
-@@ -2144,6 +2251,10 @@ static const char *path_init(struct nameidata *nd, unsigned flags)
+@@ -2141,6 +2248,10 @@ static const char *path_init(struct nameidata *nd, unsigned flags)
  	nd->last_type = LAST_ROOT; /* if there are only slashes... */
  	nd->flags = flags | LOOKUP_JUMPED | LOOKUP_PARENT;
  	nd->depth = 0;
@@ -111925,7 +111640,7 @@ index 5b4eed2..ad403ae 100644
  	if (flags & LOOKUP_ROOT) {
  		struct dentry *root = nd->root.dentry;
  		struct inode *inode = root->d_inode;
-@@ -2275,6 +2386,14 @@ static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path
+@@ -2272,6 +2383,14 @@ static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path
  	if (!err)
  		err = complete_walk(nd);
  
@@ -111940,7 +111655,7 @@ index 5b4eed2..ad403ae 100644
  	if (!err && nd->flags & LOOKUP_DIRECTORY)
  		if (!d_can_lookup(nd->path.dentry))
  			err = -ENOTDIR;
-@@ -2323,6 +2442,14 @@ static int path_parentat(struct nameidata *nd, unsigned flags,
+@@ -2320,6 +2439,14 @@ static int path_parentat(struct nameidata *nd, unsigned flags,
  	err = link_path_walk(s, nd);
  	if (!err)
  		err = complete_walk(nd);
@@ -111955,7 +111670,7 @@ index 5b4eed2..ad403ae 100644
  	if (!err) {
  		*parent = nd->path;
  		nd->path.mnt = NULL;
-@@ -2940,6 +3067,13 @@ static int may_open(struct path *path, int acc_mode, int flag)
+@@ -2937,6 +3064,13 @@ static int may_open(struct path *path, int acc_mode, int flag)
  	if (flag & O_NOATIME && !inode_owner_or_capable(inode))
  		return -EPERM;
  
@@ -111969,7 +111684,7 @@ index 5b4eed2..ad403ae 100644
  	return 0;
  }
  
-@@ -3179,6 +3313,20 @@ static int lookup_open(struct nameidata *nd, struct path *path,
+@@ -3176,6 +3310,20 @@ static int lookup_open(struct nameidata *nd, struct path *path,
  
  	/* Negative dentry, just create the file */
  	if (!dentry->d_inode && (open_flag & O_CREAT)) {
@@ -111990,7 +111705,7 @@ index 5b4eed2..ad403ae 100644
  		*opened |= FILE_CREATED;
  		audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE);
  		if (!dir_inode->i_op->create) {
-@@ -3189,6 +3337,7 @@ static int lookup_open(struct nameidata *nd, struct path *path,
+@@ -3186,6 +3334,7 @@ static int lookup_open(struct nameidata *nd, struct path *path,
  						open_flag & O_EXCL);
  		if (error)
  			goto out_dput;
@@ -111998,7 +111713,7 @@ index 5b4eed2..ad403ae 100644
  		fsnotify_create(dir_inode, dentry);
  	}
  	if (unlikely(create_error) && !dentry->d_inode) {
-@@ -3303,6 +3452,11 @@ static int do_last(struct nameidata *nd,
+@@ -3300,6 +3449,11 @@ static int do_last(struct nameidata *nd,
  		goto finish_open_created;
  	}
  
@@ -112010,7 +111725,7 @@ index 5b4eed2..ad403ae 100644
  	/*
  	 * If atomic_open() acquired write access it is dropped now due to
  	 * possible mount and symlink following (this might be optimized away if
-@@ -3322,6 +3476,13 @@ static int do_last(struct nameidata *nd,
+@@ -3319,6 +3473,13 @@ static int do_last(struct nameidata *nd,
  		return -ENOENT;
  	}
  
@@ -112024,7 +111739,7 @@ index 5b4eed2..ad403ae 100644
  	/*
  	 * create/update audit record if it already exists.
  	 */
-@@ -3350,6 +3511,21 @@ static int do_last(struct nameidata *nd,
+@@ -3347,6 +3508,21 @@ static int do_last(struct nameidata *nd,
  	error = complete_walk(nd);
  	if (error)
  		return error;
@@ -112046,7 +111761,7 @@ index 5b4eed2..ad403ae 100644
  	audit_inode(nd->name, nd->path.dentry, 0);
  	error = -EISDIR;
  	if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry))
-@@ -3606,9 +3782,11 @@ static struct dentry *filename_create(int dfd, struct filename *name,
+@@ -3603,9 +3779,11 @@ static struct dentry *filename_create(int dfd, struct filename *name,
  		goto unlock;
  
  	error = -EEXIST;
@@ -112060,7 +111775,7 @@ index 5b4eed2..ad403ae 100644
  	/*
  	 * Special case - lookup gave negative, but... we had foo/bar/
  	 * From the vfs_mknod() POV we just have a negative dentry -
-@@ -3662,6 +3840,20 @@ inline struct dentry *user_path_create(int dfd, const char __user *pathname,
+@@ -3659,6 +3837,20 @@ inline struct dentry *user_path_create(int dfd, const char __user *pathname,
  }
  EXPORT_SYMBOL(user_path_create);
  
@@ -112081,7 +111796,7 @@ index 5b4eed2..ad403ae 100644
  int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
  {
  	int error = may_create(dir, dentry);
-@@ -3725,6 +3917,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
+@@ -3722,6 +3914,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
  
  	if (!IS_POSIXACL(path.dentry->d_inode))
  		mode &= ~current_umask();
@@ -112099,7 +111814,7 @@ index 5b4eed2..ad403ae 100644
  	error = security_path_mknod(&path, dentry, mode, dev);
  	if (error)
  		goto out;
-@@ -3742,6 +3945,8 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
+@@ -3739,6 +3942,8 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
  			error = vfs_mknod(path.dentry->d_inode,dentry,mode,0);
  			break;
  	}
@@ -112108,7 +111823,7 @@ index 5b4eed2..ad403ae 100644
  out:
  	done_path_create(&path, dentry);
  	if (retry_estale(error, lookup_flags)) {
-@@ -3796,9 +4001,16 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode)
+@@ -3793,9 +3998,16 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode)
  
  	if (!IS_POSIXACL(path.dentry->d_inode))
  		mode &= ~current_umask();
@@ -112125,7 +111840,7 @@ index 5b4eed2..ad403ae 100644
  	done_path_create(&path, dentry);
  	if (retry_estale(error, lookup_flags)) {
  		lookup_flags |= LOOKUP_REVAL;
-@@ -3859,6 +4071,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
+@@ -3856,6 +4068,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
  	struct path path;
  	struct qstr last;
  	int type;
@@ -112134,7 +111849,7 @@ index 5b4eed2..ad403ae 100644
  	unsigned int lookup_flags = 0;
  retry:
  	name = user_path_parent(dfd, pathname,
-@@ -3891,10 +4105,20 @@ static long do_rmdir(int dfd, const char __user *pathname)
+@@ -3888,10 +4102,20 @@ static long do_rmdir(int dfd, const char __user *pathname)
  		error = -ENOENT;
  		goto exit3;
  	}
@@ -112155,7 +111870,7 @@ index 5b4eed2..ad403ae 100644
  exit3:
  	dput(dentry);
  exit2:
-@@ -3989,6 +4213,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
+@@ -3986,6 +4210,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
  	int type;
  	struct inode *inode = NULL;
  	struct inode *delegated_inode = NULL;
@@ -112164,7 +111879,7 @@ index 5b4eed2..ad403ae 100644
  	unsigned int lookup_flags = 0;
  retry:
  	name = user_path_parent(dfd, pathname,
-@@ -4015,10 +4241,21 @@ static long do_unlinkat(int dfd, const char __user *pathname)
+@@ -4012,10 +4238,21 @@ static long do_unlinkat(int dfd, const char __user *pathname)
  		if (d_is_negative(dentry))
  			goto slashes;
  		ihold(inode);
@@ -112186,7 +111901,7 @@ index 5b4eed2..ad403ae 100644
  exit2:
  		dput(dentry);
  	}
-@@ -4107,9 +4344,17 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
+@@ -4104,9 +4341,17 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
  	if (IS_ERR(dentry))
  		goto out_putname;
  
@@ -112204,7 +111919,7 @@ index 5b4eed2..ad403ae 100644
  	done_path_create(&path, dentry);
  	if (retry_estale(error, lookup_flags)) {
  		lookup_flags |= LOOKUP_REVAL;
-@@ -4220,6 +4465,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
+@@ -4217,6 +4462,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
  	struct dentry *new_dentry;
  	struct path old_path, new_path;
  	struct inode *delegated_inode = NULL;
@@ -112212,7 +111927,7 @@ index 5b4eed2..ad403ae 100644
  	int how = 0;
  	int error;
  
-@@ -4243,7 +4489,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
+@@ -4240,7 +4486,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
  	if (error)
  		return error;
  
@@ -112221,7 +111936,7 @@ index 5b4eed2..ad403ae 100644
  					(how & LOOKUP_REVAL));
  	error = PTR_ERR(new_dentry);
  	if (IS_ERR(new_dentry))
-@@ -4255,11 +4501,26 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
+@@ -4252,11 +4498,26 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
  	error = may_linkat(&old_path);
  	if (unlikely(error))
  		goto out_dput;
@@ -112248,7 +111963,7 @@ index 5b4eed2..ad403ae 100644
  	done_path_create(&new_path, new_dentry);
  	if (delegated_inode) {
  		error = break_deleg_wait(&delegated_inode);
-@@ -4569,6 +4830,20 @@ SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname,
+@@ -4566,6 +4827,20 @@ SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname,
  	if (new_dentry == trap)
  		goto exit5;
  
@@ -112269,7 +111984,7 @@ index 5b4eed2..ad403ae 100644
  	error = security_path_rename(&old_path, old_dentry,
  				     &new_path, new_dentry, flags);
  	if (error)
-@@ -4576,6 +4851,9 @@ SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname,
+@@ -4573,6 +4848,9 @@ SYSCALL_DEFINE5(renameat2, int, olddfd, const char __user *, oldname,
  	error = vfs_rename(old_path.dentry->d_inode, old_dentry,
  			   new_path.dentry->d_inode, new_dentry,
  			   &delegated_inode, flags);
@@ -112280,10 +111995,19 @@ index 5b4eed2..ad403ae 100644
  	dput(new_dentry);
  exit4:
 diff --git a/fs/namespace.c b/fs/namespace.c
-index 7cea503..ff1c5ec 100644
+index 5e35057..ff2d458 100644
 --- a/fs/namespace.c
 +++ b/fs/namespace.c
-@@ -1551,6 +1551,9 @@ static int do_umount(struct mount *mnt, int flags)
+@@ -904,7 +904,7 @@ void mnt_change_mountpoint(struct mount *parent, struct mountpoint *mp, struct m
+ 	 * which happens well after mnt_change_mountpoint.
+ 	 */
+ 	spin_lock(&old_mountpoint->d_lock);
+-	old_mountpoint->d_lockref.count--;
++	__lockref_dec(&old_mountpoint->d_lockref);
+ 	spin_unlock(&old_mountpoint->d_lock);
+ 
+ 	mnt_add_count(old_parent, -1);
+@@ -1568,6 +1568,9 @@ static int do_umount(struct mount *mnt, int flags)
  		if (!(sb->s_flags & MS_RDONLY))
  			retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
  		up_write(&sb->s_umount);
@@ -112293,7 +112017,7 @@ index 7cea503..ff1c5ec 100644
  		return retval;
  	}
  
-@@ -1573,6 +1576,9 @@ static int do_umount(struct mount *mnt, int flags)
+@@ -1590,6 +1593,9 @@ static int do_umount(struct mount *mnt, int flags)
  	}
  	unlock_mount_hash();
  	namespace_unlock();
@@ -112303,7 +112027,7 @@ index 7cea503..ff1c5ec 100644
  	return retval;
  }
  
-@@ -1636,7 +1642,7 @@ static inline bool may_mandlock(void)
+@@ -1653,7 +1659,7 @@ static inline bool may_mandlock(void)
   * unixes. Our API is identical to OSF/1 to avoid making a mess of AMD
   */
  
@@ -112312,7 +112036,7 @@ index 7cea503..ff1c5ec 100644
  {
  	struct path path;
  	struct mount *mnt;
-@@ -1681,7 +1687,7 @@ SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
+@@ -1698,7 +1704,7 @@ SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
  /*
   *	The 2.0 compatible umount. No flags.
   */
@@ -112321,9 +112045,9 @@ index 7cea503..ff1c5ec 100644
  {
  	return sys_umount(name, 0);
  }
-@@ -2771,6 +2777,16 @@ long do_mount(const char *dev_name, const char __user *dir_name,
+@@ -2796,6 +2802,16 @@ long do_mount(const char *dev_name, const char __user *dir_name,
  		   MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
- 		   MS_STRICTATIME | MS_NOREMOTELOCK);
+ 		   MS_STRICTATIME | MS_NOREMOTELOCK | MS_SUBMOUNT);
  
 +	if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
 +		retval = -EPERM;
@@ -112338,7 +112062,7 @@ index 7cea503..ff1c5ec 100644
  	if (flags & MS_REMOUNT)
  		retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
  				    data_page);
-@@ -2784,7 +2800,10 @@ long do_mount(const char *dev_name, const char __user *dir_name,
+@@ -2809,7 +2825,10 @@ long do_mount(const char *dev_name, const char __user *dir_name,
  		retval = do_new_mount(&path, type_page, flags, mnt_flags,
  				      dev_name, data_page);
  dput_out:
@@ -112349,7 +112073,7 @@ index 7cea503..ff1c5ec 100644
  	return retval;
  }
  
-@@ -2813,7 +2832,7 @@ static void free_mnt_ns(struct mnt_namespace *ns)
+@@ -2838,7 +2857,7 @@ static void free_mnt_ns(struct mnt_namespace *ns)
   * number incrementing at 10Ghz will take 12,427 years to wrap which
   * is effectively never, so we can ignore the possibility.
   */
@@ -112358,7 +112082,7 @@ index 7cea503..ff1c5ec 100644
  
  static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)
  {
-@@ -2837,7 +2856,7 @@ static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)
+@@ -2862,7 +2881,7 @@ static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)
  		return ERR_PTR(ret);
  	}
  	new_ns->ns.ops = &mntns_operations;
@@ -112367,7 +112091,7 @@ index 7cea503..ff1c5ec 100644
  	atomic_set(&new_ns->count, 1);
  	new_ns->root = NULL;
  	INIT_LIST_HEAD(&new_ns->list);
-@@ -2974,8 +2993,8 @@ struct dentry *mount_subtree(struct vfsmount *mnt, const char *name)
+@@ -2999,8 +3018,8 @@ struct dentry *mount_subtree(struct vfsmount *mnt, const char *name)
  }
  EXPORT_SYMBOL(mount_subtree);
  
@@ -112378,7 +112102,7 @@ index 7cea503..ff1c5ec 100644
  {
  	int ret;
  	char *kernel_type;
-@@ -3081,6 +3100,11 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
+@@ -3106,6 +3125,11 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
  	if (error)
  		goto out2;
  
@@ -112390,7 +112114,7 @@ index 7cea503..ff1c5ec 100644
  	get_fs_root(current->fs, &root);
  	old_mp = lock_mount(&old);
  	error = PTR_ERR(old_mp);
-@@ -3420,7 +3444,7 @@ static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns)
+@@ -3445,7 +3469,7 @@ static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns)
  	    !ns_capable(current_user_ns(), CAP_SYS_ADMIN))
  		return -EPERM;
  
@@ -121145,10 +120869,10 @@ index d3ed817..d6038021 100644
  	}
  	putname(tmp);
 diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c
-index c48859f..d6ff862 100644
+index 67c2435..a1f43ba 100644
 --- a/fs/orangefs/super.c
 +++ b/fs/orangefs/super.c
-@@ -566,10 +566,12 @@ void orangefs_kill_sb(struct super_block *sb)
+@@ -573,10 +573,12 @@ void orangefs_kill_sb(struct super_block *sb)
  
  int orangefs_inode_cache_initialize(void)
  {
@@ -124246,7 +123970,7 @@ index bc045c7..68725c1 100644
  	generic_fillattr(inode, stat);
  	return 0;
 diff --git a/fs/super.c b/fs/super.c
-index c183835..9a1cac8 100644
+index 1058bf3..c3e0b54 100644
 --- a/fs/super.c
 +++ b/fs/super.c
 @@ -357,7 +357,8 @@ EXPORT_SYMBOL(deactivate_super);
@@ -138560,10 +138284,10 @@ index 5beed7b..2b3dcac 100644
  }
  
 diff --git a/include/linux/debugfs.h b/include/linux/debugfs.h
-index 1b413a9..3dd3735 100644
+index b20a094..08201a6 100644
 --- a/include/linux/debugfs.h
 +++ b/include/linux/debugfs.h
-@@ -139,6 +139,8 @@ struct dentry *debugfs_create_size_t(const char *name, umode_t mode,
+@@ -140,6 +140,8 @@ struct dentry *debugfs_create_size_t(const char *name, umode_t mode,
  				     struct dentry *parent, size_t *value);
  struct dentry *debugfs_create_atomic_t(const char *name, umode_t mode,
  				     struct dentry *parent, atomic_t *value);
@@ -138572,7 +138296,7 @@ index 1b413a9..3dd3735 100644
  struct dentry *debugfs_create_bool(const char *name, umode_t mode,
  				  struct dentry *parent, bool *value);
  
-@@ -321,6 +323,12 @@ static inline struct dentry *debugfs_create_atomic_t(const char *name, umode_t m
+@@ -322,6 +324,12 @@ static inline struct dentry *debugfs_create_atomic_t(const char *name, umode_t m
  	return ERR_PTR(-ENODEV);
  }
  
@@ -142005,7 +141729,7 @@ index 52666d9..f10563b 100644
  	    .ops = &param_ops_##type,					\
  	    .elemsize = sizeof(array[0]), .elem = array };		\
 diff --git a/include/linux/mount.h b/include/linux/mount.h
-index 1172cce..2d97d14 100644
+index e0f3a82..377fcf1 100644
 --- a/include/linux/mount.h
 +++ b/include/linux/mount.h
 @@ -67,7 +67,7 @@ struct vfsmount {
@@ -155131,7 +154855,7 @@ index 9c14373..5ddd763 100644
  		*data_page = bpage;
  
 diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
-index 8696ce6..3bd9109 100644
+index 90b66ed..c34206c 100644
 --- a/kernel/trace/trace.c
 +++ b/kernel/trace/trace.c
 @@ -3883,7 +3883,7 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set)
@@ -157579,7 +157303,7 @@ index 93fb63e..0aa6448 100644
  	if (end == start)
  		return error;
 diff --git a/mm/memcontrol.c b/mm/memcontrol.c
-index 4c6ade5..5601b72 100644
+index 0de2669..1489e01 100644
 --- a/mm/memcontrol.c
 +++ b/mm/memcontrol.c
 @@ -701,7 +701,7 @@ static void memcg_check_events(struct mem_cgroup *memcg, struct page *page)
@@ -158461,7 +158185,7 @@ index 66ce6b4..c5f0a41 100644
  		err = -EPERM;
  		goto out;
 diff --git a/mm/mlock.c b/mm/mlock.c
-index cdbed8a..2a0ceb7 100644
+index 665ab75..41833e6 100644
 --- a/mm/mlock.c
 +++ b/mm/mlock.c
 @@ -14,6 +14,7 @@
@@ -158472,7 +158196,7 @@ index cdbed8a..2a0ceb7 100644
  #include <linux/sched.h>
  #include <linux/export.h>
  #include <linux/rmap.h>
-@@ -579,7 +580,7 @@ static int apply_vma_lock_flags(unsigned long start, size_t len,
+@@ -578,7 +579,7 @@ static int apply_vma_lock_flags(unsigned long start, size_t len,
  {
  	unsigned long nstart, end, tmp;
  	struct vm_area_struct * vma, * prev;
@@ -158481,7 +158205,7 @@ index cdbed8a..2a0ceb7 100644
  
  	VM_BUG_ON(offset_in_page(start));
  	VM_BUG_ON(len != PAGE_ALIGN(len));
-@@ -588,6 +589,9 @@ static int apply_vma_lock_flags(unsigned long start, size_t len,
+@@ -587,6 +588,9 @@ static int apply_vma_lock_flags(unsigned long start, size_t len,
  		return -EINVAL;
  	if (end == start)
  		return 0;
@@ -158491,7 +158215,7 @@ index cdbed8a..2a0ceb7 100644
  	vma = find_vma(current->mm, start);
  	if (!vma || vma->vm_start > start)
  		return -ENOMEM;
-@@ -597,8 +601,14 @@ static int apply_vma_lock_flags(unsigned long start, size_t len,
+@@ -596,8 +600,14 @@ static int apply_vma_lock_flags(unsigned long start, size_t len,
  		prev = vma;
  
  	for (nstart = start ; ; ) {
@@ -158507,7 +158231,7 @@ index cdbed8a..2a0ceb7 100644
  		newflags |= flags;
  
  		/* Here we know that  vma->vm_start <= nstart < vma->vm_end. */
-@@ -696,6 +706,10 @@ static __must_check int do_mlock(unsigned long start, size_t len, vm_flags_t fla
+@@ -695,6 +705,10 @@ static __must_check int do_mlock(unsigned long start, size_t len, vm_flags_t fla
  	}
  
  	/* check against resource limits */
@@ -158518,7 +158242,7 @@ index cdbed8a..2a0ceb7 100644
  	if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
  		error = apply_vma_lock_flags(start, len, flags);
  
-@@ -777,6 +791,11 @@ static int apply_mlockall_flags(int flags)
+@@ -776,6 +790,11 @@ static int apply_mlockall_flags(int flags)
  	for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
  		vm_flags_t newflags;
  
@@ -158530,7 +158254,7 @@ index cdbed8a..2a0ceb7 100644
  		newflags = vma->vm_flags & VM_LOCKED_CLEAR_MASK;
  		newflags |= to_add;
  
-@@ -809,6 +828,10 @@ SYSCALL_DEFINE1(mlockall, int, flags)
+@@ -808,6 +827,10 @@ SYSCALL_DEFINE1(mlockall, int, flags)
  		return -EINTR;
  
  	ret = -ENOMEM;
@@ -168790,7 +168514,7 @@ index 1075ac2..0bd82e4 100644
  		/*
  		 * Goal:
 diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
-index 28a3a09..fa99879 100644
+index 76a8bcd..4cb8050 100644
 --- a/net/mac80211/pm.c
 +++ b/net/mac80211/pm.c
 @@ -19,7 +19,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
diff --git a/4.9.14/4425_grsec_remove_EI_PAX.patch b/4.9.15/4425_grsec_remove_EI_PAX.patch
index 594598a..594598a 100644
--- a/4.9.14/4425_grsec_remove_EI_PAX.patch
+++ b/4.9.15/4425_grsec_remove_EI_PAX.patch
diff --git a/4.9.14/4426_default_XATTR_PAX_FLAGS.patch b/4.9.15/4426_default_XATTR_PAX_FLAGS.patch
index f7e97b5..f7e97b5 100644
--- a/4.9.14/4426_default_XATTR_PAX_FLAGS.patch
+++ b/4.9.15/4426_default_XATTR_PAX_FLAGS.patch
diff --git a/4.9.14/4427_force_XATTR_PAX_tmpfs.patch b/4.9.15/4427_force_XATTR_PAX_tmpfs.patch
index 3871139..3871139 100644
--- a/4.9.14/4427_force_XATTR_PAX_tmpfs.patch
+++ b/4.9.15/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/4.9.14/4430_grsec-remove-localversion-grsec.patch b/4.9.15/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/4.9.14/4430_grsec-remove-localversion-grsec.patch
+++ b/4.9.15/4430_grsec-remove-localversion-grsec.patch
diff --git a/4.9.14/4435_grsec-mute-warnings.patch b/4.9.15/4435_grsec-mute-warnings.patch
index 8929222..8929222 100644
--- a/4.9.14/4435_grsec-mute-warnings.patch
+++ b/4.9.15/4435_grsec-mute-warnings.patch
diff --git a/4.9.14/4440_grsec-remove-protected-paths.patch b/4.9.15/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/4.9.14/4440_grsec-remove-protected-paths.patch
+++ b/4.9.15/4440_grsec-remove-protected-paths.patch
diff --git a/4.9.14/4450_grsec-kconfig-default-gids.patch b/4.9.15/4450_grsec-kconfig-default-gids.patch
index cee6e27..cee6e27 100644
--- a/4.9.14/4450_grsec-kconfig-default-gids.patch
+++ b/4.9.15/4450_grsec-kconfig-default-gids.patch
diff --git a/4.9.14/4465_selinux-avc_audit-log-curr_ip.patch b/4.9.15/4465_selinux-avc_audit-log-curr_ip.patch
index 06a5294..06a5294 100644
--- a/4.9.14/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/4.9.15/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/4.9.14/4470_disable-compat_vdso.patch b/4.9.15/4470_disable-compat_vdso.patch
index a1401d8..a1401d8 100644
--- a/4.9.14/4470_disable-compat_vdso.patch
+++ b/4.9.15/4470_disable-compat_vdso.patch
diff --git a/4.9.14/4475_emutramp_default_on.patch b/4.9.15/4475_emutramp_default_on.patch
index feb8c7b..feb8c7b 100644
--- a/4.9.14/4475_emutramp_default_on.patch
+++ b/4.9.15/4475_emutramp_default_on.patch